\u7f72\u540d\u7de8\u306e\u8a55\u5224\u304c\u826f\u3044\u3088\u3046\u306a\u306e\u3067\u3001\u6b21\u306f\u691c\u8a3c\uff08Validation\uff09\u7de8\u3002<\/p>\n
\u3068\u601d\u3063\u305f\u306e\u3060\u304c\u3001\u30aa\u30e9\u30af\u30eb\u516c\u5f0f\u30b5\u30f3\u30d7\u30eb\u304c\u8208\u5473\u6df1\u304b\u3063\u305f\u306e\u3067\u518d\u63b2\u3002
\n\u30ec\u30d3\u30e5\u30fc\u3057\u3066\u307f\u308b\u3002<\/p>\n
\u305d\u306e\u30b3\u30fc\u30c9\u306f\u3053\u3046\u3060\u3002<\/p>\n
import javax.xml.crypto.*;\r\nimport javax.xml.crypto.dsig.*;\r\nimport javax.xml.crypto.dom.*;\r\nimport javax.xml.crypto.dsig.dom.DOMValidateContext;\r\nimport javax.xml.crypto.dsig.keyinfo.*;\r\nimport java.io.FileInputStream;\r\nimport java.security.*;\r\nimport java.util.Collections;\r\nimport java.util.Iterator;\r\nimport java.util.List;\r\nimport javax.xml.parsers.DocumentBuilderFactory;\r\nimport org.w3c.dom.Document;\r\nimport org.w3c.dom.NodeList;\r\n\r\n\/**\r\n * This is a simple example of validating an XML \r\n * Signature using the JSR 105 API. It assumes the key needed to\r\n * validate the signature is contained in a KeyValue KeyInfo. \r\n *\/\r\npublic class Validate {\r\n\r\n \/\/\r\n \/\/ Synopsis: java Validate [document]\r\n \/\/\r\n \/\/\t where \"document\" is the name of a file containing the XML document\r\n \/\/\t to be validated.\r\n \/\/\r\n public static void main(String[] args) throws Exception {\r\n\r\n\t\/\/ Instantiate the document to be validated\r\n\tDocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();\r\n\tdbf.setNamespaceAware(true);\r\n\tDocument doc =\r\n dbf.newDocumentBuilder().parse(new FileInputStream(args[0]));\r\n\r\n\t\/\/ Find Signature element\r\n\tNodeList nl = \r\n\t doc.getElementsByTagNameNS(XMLSignature.XMLNS, \"Signature\");\r\n\tif (nl.getLength() == 0) {\r\n\t throw new Exception(\"Cannot find Signature element\");\r\n\t}\r\n\r\n\t\/\/ Create a DOM XMLSignatureFactory that will be used to unmarshal the \r\n\t\/\/ document containing the XMLSignature \r\n\tXMLSignatureFactory fac = XMLSignatureFactory.getInstance(\"DOM\");\r\n\r\n\t\/\/ Create a DOMValidateContext and specify a KeyValue KeySelector\r\n \/\/ and document context\r\n\tDOMValidateContext valContext = new DOMValidateContext\r\n\t (new KeyValueKeySelector(), nl.item(0));\r\n\t\r\n\t\/\/ unmarshal the XMLSignature\r\n\tXMLSignature signature = fac.unmarshalXMLSignature(valContext);\r\n\r\n\t\/\/ Validate the XMLSignature (generated above)\r\n\tboolean coreValidity = signature.validate(valContext); \r\n\r\n\t\/\/ Check core validation status\r\n\tif (coreValidity == false) {\r\n \t System.err.println(\"Signature failed core validation\"); \r\n\t boolean sv = signature.getSignatureValue().validate(valContext);\r\n\t System.out.println(\"signature validation status: \" + sv);\r\n\t \/\/ check the validation status of each Reference\r\n\t Iterator i = signature.getSignedInfo().getReferences().iterator();\r\n\t for (int j=0; i.hasNext(); j++) {\r\n\t\tboolean refValid = \r\n\t\t ((Reference) i.next()).validate(valContext);\r\n\t\tSystem.out.println(\"ref[\"+j+\"] validity status: \" + refValid);\r\n\t }\r\n\t} else {\r\n \t System.out.println(\"Signature passed core validation\");\r\n\t}\r\n }\r\n\r\n \/**\r\n * KeySelector which retrieves the public key out of the\r\n * KeyValue element and returns it.\r\n * NOTE: If the key algorithm doesn't match signature algorithm,\r\n * then the public key will be ignored.\r\n *\/\r\n private static class KeyValueKeySelector extends KeySelector {\r\n\tpublic KeySelectorResult select(KeyInfo keyInfo,\r\n KeySelector.Purpose purpose,\r\n AlgorithmMethod method,\r\n XMLCryptoContext context)\r\n throws KeySelectorException {\r\n if (keyInfo == null) {\r\n\t\tthrow new KeySelectorException(\"Null KeyInfo object!\");\r\n }\r\n SignatureMethod sm = (SignatureMethod) method;\r\n List list = keyInfo.getContent();\r\n\r\n for (int i = 0; i < list.size(); i++) {\r\n\t\tXMLStructure xmlStructure = (XMLStructure) list.get(i);\r\n \tif (xmlStructure instanceof KeyValue) {\r\n PublicKey pk = null;\r\n try {\r\n pk = ((KeyValue)xmlStructure).getPublicKey();\r\n } catch (KeyException ke) {\r\n throw new KeySelectorException(ke);\r\n }\r\n \/\/ make sure algorithm is compatible with method\r\n if (algEquals(sm.getAlgorithm(), pk.getAlgorithm())) {\r\n return new SimpleKeySelectorResult(pk);\r\n }\r\n\t\t}\r\n }\r\n throw new KeySelectorException(\"No KeyValue element found!\");\r\n\t}\r\n\r\n \/\/@@@FIXME: this should also work for key types other than DSA\/RSA\r\n\tstatic boolean algEquals(String algURI, String algName) {\r\n if (algName.equalsIgnoreCase(\"DSA\") &&\r\n\t\talgURI.equalsIgnoreCase(SignatureMethod.DSA_SHA1)) {\r\n\t\treturn true;\r\n } else if (algName.equalsIgnoreCase(\"RSA\") &&\r\n algURI.equalsIgnoreCase(SignatureMethod.RSA_SHA1)) {\r\n\t\treturn true;\r\n } else {\r\n\t\treturn false;\r\n }\r\n\t}\r\n }\r\n\r\n private static class SimpleKeySelectorResult implements KeySelectorResult {\r\n\tprivate PublicKey pk;\r\n\tSimpleKeySelectorResult(PublicKey pk) {\r\n\t this.pk = pk;\r\n\t}\r\n\r\n\tpublic Key getKey() { return pk; }\r\n }\r\n}<\/code><\/pre>\n\u3053\u306e\u30b3\u30fc\u30c9\u81ea\u4f53\u306f\u305d\u3093\u306a\u306b\u304a\u304b\u3057\u304f\u306a\u3044\u3068\u601d\u3046\u304b\u3082\u3057\u308c\u306a\u3044\u304c\u3001\u5bfe\u8c61\u3068\u306a\u308b xml \u30d5\u30a1\u30a4\u30eb\u3082\u63b2\u793a\u3055\u308c\u3066\u3044\u3066\u305d\u308c\u306f\u3053\u3046\u3044\u3046\u3082\u306e\u3060\u3002<\/p>\n
<Envelope xmlns=\"urn:envelope\">\r\n<Signature xmlns=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#\">\r\n<SignedInfo xmlns=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#\">\r\n<CanonicalizationMethod xmlns=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#\" Algorithm=\"http:\/\/www.w3.org\/TR\/2001\/REC-xml-c14n-20010315#WithComments\"\/>\r\n<SignatureMethod xmlns=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#\" Algorithm=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#dsa-sha1\"\/>\r\n<Reference xmlns=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#\" URI=\"\">\r\n<Transforms xmlns=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#\">\r\n<Transform xmlns=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#\" Algorithm=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#enveloped-signature\"\/>\r\n<\/Transforms>\r\n<DigestMethod xmlns=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#\" Algorithm=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#sha1\"\/>\r\n<DigestValue xmlns=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#\">uooqbWYa5VCqcJCbuymBKqm17vY=<\/DigestValue>\r\n<\/Reference>\r\n<\/SignedInfo>\r\n<SignatureValue xmlns=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#\">eO7K1BdC0kzNvr1HpMf4hKoWsvl+oI04nMw55GO+Z5hyI6By3Oihow==<\/SignatureValue>\r\n<KeyInfo xmlns=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#\">\r\n<KeyValue xmlns=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#\">\r\n<DSAKeyValue xmlns=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#\">\r\n<P xmlns=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#\">\/KaCzo4Syrom78z3EQ5SbbB4sF7ey80etKII864WF64B81uRpH5t9jQTxeEu0ImbzRMqzVDZkVG9 xD7nN1kuFw==<\/P>\r\n<Q xmlns=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#\">li7dzDacuo67Jg7mtqEm2TRuOMU=<\/Q>\r\n<G xmlns=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#\">Z4Rxsnqc9E7pGknFFH2xqaryRPBaQ01khpMdLRQnG541Awtx\/XPaF5Bpsy4pNWMOHCBiNU0Nogps QW5QvnlMpA==<\/G>\r\n<Y xmlns=\"http:\/\/www.w3.org\/2000\/09\/xmldsig#\">OqFi0sGpvroi6Ut3m154QNWc6gavH3j2ZoRPDW7qVBbgk7XompuKvZe1owz0yvxq+1K+mWbL7ST+ t5nr6UFBCg==<\/Y>\r\n<\/DSAKeyValue>\r\n<\/KeyValue>\r\n<\/KeyInfo>\r\n<\/Signature>\r\n<\/Envelope><\/code><\/pre>\n\u3053\u308c\u3092 NetBeans \u3042\u305f\u308a\u3067\u5b9f\u884c\u3059\u308b\u3068\uff08\u3061\u306a\u307f\u306b Java17 \u3042\u305f\u308a\u3067\u3082\u307b\u3068\u3093\u3069\u624b\u76f4\u3057\u306a\u3057\u3067\u52d5\u304f\uff09\u30a8\u30e9\u30fc\u304c\u51fa\u3066\u304d\u3066\u3001\u305d\u306e\u30e1\u30c3\u30bb\u30fc\u30b8\u306f\u306a\u304b\u306a\u304b\u8208\u5473\u6df1\u3044\u3002<\/p>\n
Exception in thread \"main\" javax.xml.crypto.MarshalException: It is forbidden to use algorithm http:\/\/www.w3.org\/2000\/09\/xmldsig#dsa-sha1 when secure validation is enabled<\/code><\/pre>\n\u8981\u3059\u308b\u306b dsa-sha1 \u304c\u73fe\u5728\u3067\u306f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7684\u306b\u554f\u984c\u3042\u308b\u306e\u3067\u4f7f\u3048\u307e\u305b\u3093\u3088\u3001\u3068\u8b66\u544a\u3057\u3066\u304f\u308c\u308b\u308f\u3051\u3060\u3002<\/p>\n