View Javadoc

1   /*
2    * Copyright [2007] [University Corporation for Advanced Internet Development, Inc.]
3    *
4    * Licensed under the Apache License, Version 2.0 (the "License");
5    * you may not use this file except in compliance with the License.
6    * You may obtain a copy of the License at
7    *
8    * http://www.apache.org/licenses/LICENSE-2.0
9    *
10   * Unless required by applicable law or agreed to in writing, software
11   * distributed under the License is distributed on an "AS IS" BASIS,
12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13   * See the License for the specific language governing permissions and
14   * limitations under the License.
15   */
16  
17  package org.opensaml.xml.signature.validator;
18  
19  import java.util.HashSet;
20  import java.util.Set;
21  
22  import javax.xml.namespace.QName;
23  
24  import org.opensaml.xml.XMLObject;
25  import org.opensaml.xml.signature.X509CRL;
26  import org.opensaml.xml.signature.X509Certificate;
27  import org.opensaml.xml.signature.X509Data;
28  import org.opensaml.xml.signature.X509IssuerSerial;
29  import org.opensaml.xml.signature.X509SKI;
30  import org.opensaml.xml.signature.X509SubjectName;
31  import org.opensaml.xml.util.XMLConstants;
32  import org.opensaml.xml.validation.ValidationException;
33  import org.opensaml.xml.validation.Validator;
34  
35  /**
36   * Checks {@link org.opensaml.xml.signature.X509Data} for Schema compliance. 
37   */
38  public class X509DataSchemaValidator implements Validator<X509Data> {
39      
40      /** QNames corresponding to the valid children. */
41      private static final Set<QName> VALID_DS_CHILD_NAMES;
42  
43      /** {@inheritDoc} */
44      public void validate(X509Data xmlObject) throws ValidationException {
45          validateChildrenPresence(xmlObject);
46          validateChildrenNamespaces(xmlObject);
47      }
48      
49      /**
50       * Get the QNames corresponding to the valid children
51       * defined in the XML Signature namespace.
52       * 
53       * @return list of valid child QNames
54       */
55      protected static Set<QName> getValidDSChildNames() {
56          return VALID_DS_CHILD_NAMES;
57      }
58  
59      /**
60       * Validate that at least child is present.
61       * 
62       * @param xmlObject the object to validate
63       * @throws ValidationException  thrown if the object is invalid
64       */
65      protected void validateChildrenPresence(X509Data xmlObject) throws ValidationException {
66          if (xmlObject.getXMLObjects().isEmpty()) {
67              throw new ValidationException("No children were present in the X509Data object");
68          }
69      }
70      
71      /**
72       * Validate that all children are either ones defined within the XML Signature schema,
73       * or are from another namespace.
74       * 
75       * @param xmlObject the object to validate
76       * @throws ValidationException thrown if the object is invalid
77       */
78      protected void validateChildrenNamespaces(X509Data xmlObject) throws ValidationException {
79          // Validate that any children are either the ones from the dsig schema,
80          // or are from another namespace.
81          for (XMLObject child : xmlObject.getXMLObjects()) {
82              QName childName = child.getElementQName();
83              if (! getValidDSChildNames().contains(childName) 
84                      && XMLConstants.XMLSIG_NS.equals(childName.getNamespaceURI())) {
85                  throw new ValidationException("X509Data contains an illegal child extension element: " + childName);
86              }
87          }
88      }
89      
90      static {
91          VALID_DS_CHILD_NAMES = new HashSet<QName>(10);
92          VALID_DS_CHILD_NAMES.add(X509IssuerSerial.DEFAULT_ELEMENT_NAME);
93          VALID_DS_CHILD_NAMES.add(X509SKI.DEFAULT_ELEMENT_NAME);
94          VALID_DS_CHILD_NAMES.add(X509SubjectName.DEFAULT_ELEMENT_NAME);
95          VALID_DS_CHILD_NAMES.add(X509Certificate.DEFAULT_ELEMENT_NAME);
96          VALID_DS_CHILD_NAMES.add(X509CRL.DEFAULT_ELEMENT_NAME);
97      }
98  }