This is an automated email from the ASF dual-hosted git repository. chibenwa pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/james-jdkim.git
commit 1f4d1c6b368736d3b656f093e9b96356160cf37e Author: Benoit TELLIER <[email protected]> AuthorDate: Fri Oct 30 08:34:02 2026 +0100 [FIX] Use a fixed locale for case-insensitive comparisons The t=s subdomain check lower-cased i= and d= with the default locale, so under tr/az a valid [email protected] did not match d=Mail.Example.Com ("I" lower-cases to a dotless i). The JCA algorithm names and the Authentication-Results result type had the same dependency. They now use Locale.US; the i=/d= check of the record classes already compares without the default locale. Co-Authored-By: Claude Opus 5.5 <[email protected]> --- .../src/main/java/org/apache/james/jdkim/DKIMCommon.java | 2 +- .../src/main/java/org/apache/james/jdkim/DKIMSigner.java | 5 +++-- .../main/java/org/apache/james/jdkim/DKIMVerifier.java | 9 +++++---- .../src/main/java/org/apache/james/jdkim/api/Result.java | 4 +++- .../org/apache/james/jdkim/SignatureRecordImplTest.java | 16 ++++++++++++++++ 5 files changed, 28 insertions(+), 8 deletions(-) diff --git a/main/src/main/java/org/apache/james/jdkim/DKIMCommon.java b/main/src/main/java/org/apache/james/jdkim/DKIMCommon.java index 2435db8..830342a 100644 --- a/main/src/main/java/org/apache/james/jdkim/DKIMCommon.java +++ b/main/src/main/java/org/apache/james/jdkim/DKIMCommon.java @@ -53,7 +53,7 @@ public abstract class DKIMCommon { if (relaxed) { if (DEEP_DEBUG) System.out - .println("#" + header.toString().toLowerCase() + ":-"); + .println("#" + header.toString().toLowerCase(Locale.US) + ":-"); signature.update(octets(header.toString().toLowerCase(Locale.US))); signature.update(octets(":")); String headerValue = fv.substring(fv.indexOf(':') + 1); diff --git a/main/src/main/java/org/apache/james/jdkim/DKIMSigner.java b/main/src/main/java/org/apache/james/jdkim/DKIMSigner.java index c280d40..d539fdf 100644 --- a/main/src/main/java/org/apache/james/jdkim/DKIMSigner.java +++ b/main/src/main/java/org/apache/james/jdkim/DKIMSigner.java @@ -42,6 +42,7 @@ import java.security.spec.InvalidKeySpecException; import java.security.spec.PKCS8EncodedKeySpec; import java.util.Base64; import java.util.List; +import java.util.Locale; public class DKIMSigner { @@ -137,8 +138,8 @@ public class DKIMSigner { SignatureException, PermFailException { Signature signature = Signature.getInstance(sign.getHashMethod() - .toString().toUpperCase() - + "with" + sign.getHashKeyType().toString().toUpperCase()); + .toString().toUpperCase(Locale.US) + + "with" + sign.getHashKeyType().toString().toUpperCase(Locale.US)); signature.initSign(key); signatureCheck(h, sign, headers, signature); diff --git a/main/src/main/java/org/apache/james/jdkim/DKIMVerifier.java b/main/src/main/java/org/apache/james/jdkim/DKIMVerifier.java index b4bcbfc..441f998 100644 --- a/main/src/main/java/org/apache/james/jdkim/DKIMVerifier.java +++ b/main/src/main/java/org/apache/james/jdkim/DKIMVerifier.java @@ -56,6 +56,7 @@ import java.util.Iterator; import java.util.LinkedHashSet; import java.util.LinkedList; import java.util.List; +import java.util.Locale; import java.util.Map; import java.util.Set; @@ -149,8 +150,8 @@ public class DKIMVerifier { } if (pkr.isDenySubdomains()) { - if (!sign.getIdentity().toString().toLowerCase().endsWith( - ("@" + sign.getDToken()).toLowerCase())) { + if (!sign.getIdentity().toString().toLowerCase(Locale.US).endsWith( + ("@" + sign.getDToken()).toLowerCase(Locale.US))) { throw new PermFailException( "AUID in subdomain of SDID is not allowed by the public key record.", sign); } @@ -529,8 +530,8 @@ public class DKIMVerifier { throws PermFailException { try { Signature signature = Signature.getInstance(sign.getHashMethod() - .toString().toUpperCase() - + "with" + sign.getHashKeyType().toString().toUpperCase()); + .toString().toUpperCase(Locale.US) + + "with" + sign.getHashKeyType().toString().toUpperCase(Locale.US)); PublicKey publicKey; try { publicKey = key.getPublicKey(); diff --git a/main/src/main/java/org/apache/james/jdkim/api/Result.java b/main/src/main/java/org/apache/james/jdkim/api/Result.java index 443b6af..bd6cc4a 100644 --- a/main/src/main/java/org/apache/james/jdkim/api/Result.java +++ b/main/src/main/java/org/apache/james/jdkim/api/Result.java @@ -19,6 +19,8 @@ package org.apache.james.jdkim.api; +import java.util.Locale; + /** * Class to hold results of DKIMVerifier */ @@ -122,7 +124,7 @@ public class Result { } return String.format("dkim=%s header.d=%s header.s=%s%s%s", - type.toString().toLowerCase(), pvalue(sanitize(record.getDToken())), pvalue(sanitize(record.getSelector())), + type.toString().toLowerCase(Locale.US), pvalue(sanitize(record.getDToken())), pvalue(sanitize(record.getSelector())), partialSig, reasonProp); } diff --git a/main/src/test/java/org/apache/james/jdkim/SignatureRecordImplTest.java b/main/src/test/java/org/apache/james/jdkim/SignatureRecordImplTest.java index ff209a4..a67cb1c 100644 --- a/main/src/test/java/org/apache/james/jdkim/SignatureRecordImplTest.java +++ b/main/src/test/java/org/apache/james/jdkim/SignatureRecordImplTest.java @@ -19,6 +19,9 @@ package org.apache.james.jdkim; +import org.apache.james.jdkim.tagvalue.PublicKeyRecordImpl; +import org.apache.james.jdkim.tagvalue.SignatureRecordTemplate; +import java.util.Locale; import org.apache.james.jdkim.api.SignatureRecord; import org.apache.james.jdkim.tagvalue.SignatureRecordImpl; @@ -238,4 +241,17 @@ public class SignatureRecordImplTest { assertThat(new SignatureRecordImpl(base + "[email protected]").getIdentityLocalPart()).isEqualTo("joe"); assertThat(new SignatureRecordImpl(base + "[email protected]").getIdentityLocalPart()).isEqualTo(""); } + + @Test + public void identityCheckShouldNotDependOnTheDefaultLocale() throws Exception { + Locale saved = Locale.getDefault(); + Locale.setDefault(Locale.forLanguageTag("tr-TR")); + try { + new SignatureRecordTemplate("v=1; s=sel; d=Mail.Example.Com; a=rsa-sha256; h=from; [email protected]"); + SignatureRecordImpl sign = new SignatureRecordImpl("v=1; s=sel; d=Mail.Example.Com; a=rsa-sha256; h=from; bh=AA==; b=AA==; [email protected]"); + DKIMVerifier.apply(new PublicKeyRecordImpl("v=DKIM1; k=rsa; t=s; p=AAAA"), sign); + } finally { + Locale.setDefault(saved); + } + } } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
