ooo340 / libxmlsec /

Filename Size Date modified Message
5.9 KB
1.3 KB
539 B
479.6 KB
The XML Security library has been modified, so that there is NO verification
of the certificate during sign or verification operation. On Windows this was 
done in the function xmlSecMSCryptoX509StoreVerify (file 
src/mscrypto/x509vfy.c) and on UNIX in xmlSecNssX509StoreVerify 
(file src/nss/x509vfy.c).

This change requires that the XML Signature contains in 
Signature/KeyInfo/X509Data only entries which represent the same 
The implementation creates certificates from all of the X509Data children
(X509IssuerSerial, X509Certificate) and used to iterate over all certificates,
verify them and return the first "good" certificate. Now the first one is 

The X509IssuerSerial information is used by XML Security Library to find the 
certificate in the certificate store on the machine. The X509Certificate entry
is used to create a certificate no matter if this is already contained in the
certificate store.

Do not forget: Suggest to XML Security Library to provide a way to carry out 
signature operations without verification of certificates. There is flag
xmlSecKeyInfoCtx (see function xmlSecNssKeyDataX509XmlRead, in file src/nss/x509.c),
which indicates such a possibility but it does not work.
Tip: Filter by directory path e.g. /media app.js to search for public/media/app.js.
Tip: Use camelCasing e.g. ProjME to search for
Tip: Filter by extension type e.g. /repo .js to search for all .js files in the /repo directory.
Tip: Separate your search with spaces e.g. /ssh pom.xml to search for src/ssh/pom.xml.
Tip: Use ↑ and ↓ arrow keys to navigate and return to view the file.
Tip: You can also navigate files with Ctrl+j (next) and Ctrl+k (previous) and view the file with Ctrl+o.
Tip: You can also navigate files with Alt+j (next) and Alt+k (previous) and view the file with Alt+o.