DO NOT REPLY [Bug 44102] New: - XMLCipher loadEncryptedKey error

[bugzilla]

DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG·
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=44102>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND·
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=44102

           Summary: XMLCipher loadEncryptedKey error
           Product: Security
           Version: Java 1.4.1
          Platform: Other
        OS/Version: other
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Encryption
        AssignedTo: security-dev@xml.apache.org
        ReportedBy: [EMAIL PROTECTED]


I tried to use XMLCipher to load a EncryptedKey element into EncryptedKey 
object.
 
<xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"; Id="KEK" 
Recipient="demo"> 
  <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-
1_5" /> 
  <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#";>
    <ds:KeyName>demo</ds:KeyName> 
  </ds:KeyInfo>
  <xenc:CipherData>
   <xenc:CipherValue>a+CJUHCF1q4bSa5dL6oxpcHzsi2Y00dIAPB3cs=</xenc:CipherValue> 
  </xenc:CipherData>
  <xenc:ReferenceList>
    <xenc:DataReference URI="#ED"></xenc:DataReference>
  </xenc:ReferenceList>
  <xenc:CarriedKeyName>datakey</xenc:CarriedKeyName>
</xenc:EncryptedKey>

 
It's ok to load, however, when I try to call the getRecipient() function, it 
return null.
After I traced the program, I found the problem is caused by the following code 
in XMLCipher.newEncryptedKey(ELement) function:
 
        try {
            result.setId (element.getAttributeNS(
                    null, EncryptionConstants._ATT_ID));
            result.setType(new URI(
                    element.getAttributeNS(
                        null, EncryptionConstants._ATT_TYPE)).toString());
            result.setMimeType(element.getAttributeNS(
                    null, EncryptionConstants._ATT_MIMETYPE)); 
            result.setEncoding(new URI(
                    element.getAttributeNS(
                        null, Constants._ATT_ENCODING)).toString());
            result.setRecipient (element.getAttributeNS(
                    null, EncryptionConstants._ATT_RECIPIENT));
        } catch (URI.MalformedURIException mfue) {
            // do nothing
        }

 
The problem is caused by calling new URI() of _ATT_TYPE & _ATT_ENCODING and 
these 2 parameters are not required for EncryptedKey.
it throws MalformedURIException so the recipient is never been set.



Here is the test code:

import java.io.*;
import org.w3c.dom.*;
import org.xml.sax.*;
import javax.xml.parsers.*;
import javax.crypto.*;

import org.apache.xml.security.utils.*;
import org.apache.xml.security.encryption.*;

/**
 *
 * @author  justy.wong
 */
public class TestXMLCipher {
    
    /** Creates a new instance of TestXMLCipher */
    public TestXMLCipher() {
    }
    
    /**
     * @param args the command line arguments
     */
    public static void main(String[] args) throws Exception {
        if (args.length < 1) {
            System.out.println("usage : java TestXMLCipher <xml_filename>");
            System.exit(1);
        }
        
        org.apache.xml.security.Init.init();
        
        FileInputStream fin = new FileInputStream(args[0]);
        
        DocumentBuilderFactory builderFactory = 
DocumentBuilderFactory.newInstance();
        builderFactory.setNamespaceAware (true);
        DocumentBuilder builder = builderFactory.newDocumentBuilder();
        Document document = builder.parse(fin); 
        
        XMLCipher keyCipher = XMLCipher.getInstance();
        keyCipher.init(XMLCipher.UNWRAP_MODE, null);
        
        NodeList ekList = document.getElementsByTagNameNS
(EncryptionConstants.EncryptionSpecNS, EncryptionConstants._TAG_ENCRYPTEDKEY);
        for (int i =0; i<ekList.getLength(); i++) {
            EncryptedKey ek = keyCipher.loadEncryptedKey(document, (Element) 
ekList.item(i));
            System.out.println("recipient = " + ek.getRecipient());
        }
    }
    
}

-- 
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.