summaryrefslogtreecommitdiff
path: root/xmlsecurity
AgeCommit message (Collapse)Author
2022-04-11disable 2 failing pdfsigning testsMichael Stahl
These fail in jenkins but pass when built locally in a Centos7 container. pdfsigning.cxx:482:Assertion Test name: PDFSigningTest::testBadCertP1 equality assertion failed - Expected: 0 - Actual : 1 pdfsigning.cxx:498:Assertion Test name: testBadCertP3Stamp::TestBody equality assertion failed - Expected: 0 - Actual : 1
2022-04-11xmlsecurity: reject a few dangerous annotation types during pdf sig verifyMiklos Vajna
(cherry picked from commit f231dacde9df1c4aa5f4e0970535c4f4093364a7) Conflicts: xmlsecurity/source/helper/pdfsignaturehelper.cxx Reviewed-on: https://gerrit.libreoffice.org/c/core/+/105926 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit fcab45e0e22f4cf46e71856dba7ae5abd6f99bc5) Change-Id: I950b49a6e7181639daf27348ddfa0f36586baa65 Conflicts: xmlsecurity/qa/unit/pdfsigning/pdfsigning.cxx (cherry-picked from 363997c76749219b900f47043d1b17ba8ec9bccd) Change-Id: I7096222bc2547046d988e0ba28df725859270790
2022-04-06compare authors using ThumbprintCaolán McNamara
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130929 Tested-by: Jenkins Reviewed-by: Miklos Vajna <vmiklos@collabora.com> (cherry picked from commit 65442205b5b274ad309308162f150f8d41648f72) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130866 Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit a7aaa78acea4c1d51283c2fce54ff9f5339026f8) Change-Id: I338f58eb07cbf0a3d13a7dafdaddac09252a8546 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/131368 Tested-by: Michael Stahl <michael.stahl@allotropia.de> Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 2c8c221b88f2e2bb5b29a6c1bcce1ea75e98136a)
2022-04-06only use X509DataCaolán McNamara
Change-Id: I52e6588f5fac04bb26d77c1f3af470db73e41f72 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/127193 Tested-by: Jenkins Reviewed-by: Miklos Vajna <vmiklos@collabora.com> (cherry picked from commit be446d81e07b5499152efeca6ca23034e51ea5ff) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/127178 Reviewed-by: Adolfo Jayme Barrientos <fitojb@ubuntu.com> (cherry picked from commit b0404f80577de9ff69e58390c6f6ef949fdb0139) (cherry picked from commit 0268fd5a52c11f5701b10c9f9a92681c56254f17)
2022-04-06xmlsecurity: some Distinguished Names are less equal than othersMichael Stahl
It turns out that the 2 backends NSS and MS CryptoAPI generate different string representations of the same Distinguished Name in at least one corner case, when a value contains a quote " U+0022. The CryptoAPI function to generate the strings is: CertNameToStr(..., CERT_X500_NAME_STR | CERT_NAME_STR_REVERSE_FLAG, ...) This is documented on MSDN: https://docs.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-certnametostra#CERT_X500_NAME_STR NSS appears to implement RFC 1485, at least that's what the internal function is named after, or perhaps one of its several successor RFCs (not clear currently if there's a relevant difference). This is now causing trouble if a certificate with such a DN is used in a signature, created on WNT but then verified on another platform, because commit 5af5ea893bcb8a8eb472ac11133da10e5a604e66 introduced consistency checks that compare the DNs that occur as strings in META-INF/documentsignatures.xml: xmlsecurity/source/helper/xmlsignaturehelper.cxx:672: X509Data cannot be parsed The reason is that in XSecController::setX509Data() the value read from the X509IssuerSerial element (a string generated by CryptoAPI) doesn't match the value generated by NSS from the certificate parsed from the X509Certificate element, so these are erroneously interpreted as 2 distinct certificates. Try to make the EqualDistinguishedNames() more flexible so that it can try also a converted variant of the DN. (libxmlsec's NSS backend also complains that it cannot parse the DN: x509vfy.c:607: xmlSecNssX509NameRead() '' '' 12 'invalid data for 'char': actual=34 and expected comma ','' but it manages to validate the signature despite this.) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/124287 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit e63611fabd38c757809b510fbb71c077880b1081) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/124196 Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de> (cherry picked from commit 3dfe381032fc61ea31106f103dee9db8277d4d25) Change-Id: I4f72900738d1f5313146bbda7320a8f44319ebc8 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/124420 Tested-by: Michael Stahl <michael.stahl@allotropia.de> Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit ee48ce9886d884730a91c695b5d0668c6d90c740)
2022-04-06xmlsecurity: fix test failing because NSS policy forbids SHA1Michael Stahl
With Fedora's nss-3.71.0-1.fc34.x86_64 there is the problem that 8 tests including testODFGood in CppunitTest/xmlsecurity_signing fail because the crypto policy disallows SHA1 for signatures. Apparently this particular policy bit was added in NSS 3.59: https://bugzilla.mozilla.org/show_bug.cgi?id=1670835 For signatures, maybe it's not a good idea to override system policy for product builds, so do it locally in the tests, at least for now. If similar problems turn up for encrypted documents in the future, that should be fixed in product builds too of course, as encrypted documents must always be decryptable. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/123768 Tested-by: Jenkins Tested-by: Caolán McNamara <caolanm@redhat.com> Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 51e82016e8783a452fe5f7921d12c1bf20bfd6b5) xmlsecurity: fix --without-system-nss usage of NSS_SetAlgorithmPolicy The problem with commit ff572d9222ec16ffd679ae907a0bf4a8900265e1 is that it's using the wrong library; NSS_SetAlgorithmPolicy is actually in libnssutil3.so. This causes a linking problem when upgrading the internal NSS to a version that has NSS_USE_ALG_IN_ANY_SIGNATURE. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/123819 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 395c0c0bbaceadf909e0189af99c6358487c7978) Change-Id: I4f634cf5da1707fb628e63cd0cdafebdf4fc903f Reviewed-on: https://gerrit.libreoffice.org/c/core/+/123838 Tested-by: Michael Stahl <michael.stahl@allotropia.de> Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 0f3431026dbff0251efeb0b92be335841a08cc5d)
2022-04-06test: upgrade test NSS database from dbm: to sql:Michael Stahl
Fedora nss-3.69.0-1.fc34.x86_64 and Debian libnss3:amd64 2:3.70-1 no longer support the old BerekelyDB databases, so convert them to the new SQLite format for the benefit of --with-system-nss builds. This worked to do the upgrade: > certutil -N -d sql:test/new --empty-password > LD_LIBRARY_PATH=instdir/program workdir/UnpackedTarball/nss/dist/out/bin/certutil --merge -d sql:test/new --source-dir dbm:test/signing-keys Builds would fail running tests added in commit 40d70d427edddb589eda64fafc2e56536953d274 signing.cxx:551:Assertion Test name: testODFX509CertificateChain::TestBody equality assertion failed - Expected: 0 - Actual : 1 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/123586 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 907784ccce7bd8b5121888cff7f5723a55d35358) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/123643 Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 7b4b03b9cf21ecd11bc82da5f29c4ff91ad242c9) Change-Id: I00aa20703e117ebf583c3331b84e966c2cfc78cd Reviewed-on: https://gerrit.libreoffice.org/c/core/+/123837 Tested-by: Michael Stahl <michael.stahl@allotropia.de> Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 755155498b13c8724831276808c930adba891f5c)
2022-04-06xmlsecurity: fix new tests on WNTMichael Stahl
Tests added in commit 40d70d427edddb589eda64fafc2e56536953d274 don't actually run on WNT but that wasn't obvious because commit 149df1fec6472e30582162e17e04c75aee91d26a prevented running them in Jenkins on master, they failed only in the libreoffice-7-1 backport. xmlsecurity/qa/unit/signing/signing.cxx(631) : error : Assertion Test name: testODFDoubleX509Certificate::TestBody assertion failed - Expression: (nActual == SignatureState::NOTVALIDATED || nActual == SignatureState::OK) - 2 This is an oddity where NSS claims the signature in the document is valid but CryptoAPI claims it is invalid; the hashes passed into the validation functions are the same. Just allow BROKEN as an additional result value on WNT. xmlsecurity/qa/unit/signing/signing.cxx(550) : error : Assertion Test name: testODFX509CertificateChain::TestBody equality assertion failed - Expected: 0 - Actual : 1 The problem here is that with NSS the tests use a custom NSS database in test/signing-keys so we need to make these certificates available for CryptoAPI too. The following one-liner converts the NSS database to a PKCS#7 that can be loaded by CrytpAPI: > openssl crl2pkcs7 -nocrl -certfile <(certutil -d sql:test/signing-keys -L | awk '/^[^ ].*,[^ ]*,/ { printf "%s", $1; for (i = 2; i < NF; i++) { printf " %s", $i; } printf "\n"; }' | while read name; do certutil -L -d sql:test/signing-keys -a -n "${name}" ; done) > test/signing-keys/test.p7b Then one might naively assume that something like this would allow these certificates to be added temporarily as trusted CAs: + HCERTSTORE hRoot = CertOpenSystemStoreW( 0, L"Root" ) ; + HCERTSTORE const hExtra = CertOpenStore( + CERT_STORE_PROV_FILENAME_A, + PKCS_7_ASN_ENCODING | X509_ASN_ENCODING, + NULL, + CERT_STORE_OPEN_EXISTING_FLAG | CERT_STORE_READONLY_FLAG, + path); + if (hExtra != NULL && hRoot != NULL) + { + BOOL ret = CertAddStoreToCollection( + hRoot, + hExtra, + CERT_PHYSICAL_STORE_ADD_ENABLE_FLAG, + 0); + SAL_DEBUG("XXX hExtra done " << ret); + } There is no error from this, but it doesn't work. Instead, check if CertGetCertificateChain() sets the CERT_TRUST_IS_UNTRUSTED_ROOT flag and then look up the certificate manually in the extra PKCS#7 store. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/123667 Tested-by: Jenkins Reviewed-by: Miklos Vajna <vmiklos@collabora.com> (cherry picked from commit 7d664ec788acdc378506a7ff8b1120cea24a6770) Change-Id: Ic9865e0b5783211c2128ce0327c4583b7784ff62 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/123836 Tested-by: Michael Stahl <michael.stahl@allotropia.de> Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 7c622c58cda433964dd73544d56a81a7c88e3f5d)
2022-04-06xmlsecurity: add tests for multiple X509Data/X509CertificateMichael Stahl
Change-Id: If50ae8156f81c1053aa8fbfc3148da64bb8e1442 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/123438 Tested-by: Michael Stahl <michael.stahl@allotropia.de> Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 956c638025e3c0bbe816f710da64769cf5874f4f)
2022-04-06xmlsecurity: add test for timestampsMichael Stahl
Change-Id: I6ce64ca7c59639684779144ed0ed8d36c4aca32b Reviewed-on: https://gerrit.libreoffice.org/c/core/+/123437 Tested-by: Michael Stahl <michael.stahl@allotropia.de> Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 3aabce61782c9561a0e1680fe1ecc58ac87be0ee)
2022-04-06do same set error state as ReadAndVerifySignature doesCaolán McNamara
this function is nearly exactly the same as ReadAndVerifySignature except it doesn't set error-state on exception during parse Change-Id: Ife881f639a11d3185920ca62cc2cd22812fae36d Reviewed-on: https://gerrit.libreoffice.org/c/core/+/112366 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> Reviewed-by: Miklos Vajna <vmiklos@collabora.com> Reviewed-on: https://gerrit.libreoffice.org/c/core/+/112412 (cherry picked from commit 52a23d595b820cab27d76d0e7c129f2757c762d6) (cherry picked from commit ed6db8f42484f135137939cf38dc40fc3f0913b1)
2022-04-06Revert "Comment out failing unit test"Michael Stahl
This reverts commit df1033d3e5692ea11dc2ac9ea08e8a245996dab1.
2022-04-05Revert "only use X509Data"Gabor Kelemen
This reverts commit 5c494aa3c72b1f833999bdc55a7cdf9403678f87. Not helpful in itself, revert until all xmlsecurity is backported
2022-04-01only use X509DataCaolán McNamara
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/127193 Tested-by: Jenkins Reviewed-by: Miklos Vajna <vmiklos@collabora.com> (cherry picked from commit be446d81e07b5499152efeca6ca23034e51ea5ff) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/127178 Reviewed-by: Adolfo Jayme Barrientos <fitojb@ubuntu.com> (cherry picked from commit b0404f80577de9ff69e58390c6f6ef949fdb0139) Change-Id: I52e6588f5fac04bb26d77c1f3af470db73e41f72
2021-11-11Comment out failing unit testGabor Kelemen
Change-Id: If2d4f24e146c88f7c7263c1419ddd110acbef4b2
2021-11-09Fix unit test break in ECDSA OOXML testGabor Kelemen
Accidental regression from commit 7ecb0f495183a7b3da97a3b24eeba9566c41314c Change-Id: Ieff4f50d836ddcf08c2b5e63a2336cf18b533043
2021-11-09Revert "Temporarily comment out failing unit test"Gabor Kelemen
This reverts commit 2eba6e2f3878f71302ae17ee3a3fa5fac04cbc95. Better solution has been found
2021-11-09Temporarily comment out failing unit testGabor Kelemen
Change-Id: I8de05b8ada12c8c9b80f33836823d0626e9b33e5
2021-11-04Revert "xmlsecurity: reject a few dangerous annotation types during pdf sig ↵Gabor Kelemen
verify" This reverts commit 4ebc328779539d9bc0cb0d7759c27e1e155c129e. Older pdfium does not have FPDF_ANNOT_REDACT yet
2021-04-20Adjust various unit tests past-backportsThorsten Behrens
Change-Id: I44fac2793a62a8cd33b0d5c8b28c1db726960a77
2021-04-18xmlsecurity: downgrade to support gcc 4.8.2Vasily Melenchuk
* pre stdcxx17 compilers do not support nested namespaces * std::make_unique is not supported (replaced by o3tl::make_unique) * extra usage of #include <memory>: it did fail wihout it in some cases * rewriting lambdas: they are working really bad in old versions Change-Id: I2c99ababa16de76549c976c79c6a8ab7927ad200
2021-04-16xmlsecurity: replace OOXMLSecParser implementationMichael Stahl
This is similar to 12b15be8f4f930a04d8056b9219ac969b42a9784 and following commits, but OOXMLSecParser has some differences to XSecParser, such as using a ds:Manifest, and requires a couple extra namespaces. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/113381 Tested-by: Jenkins Reviewed-by: Miklos Vajna <vmiklos@collabora.com> (cherry picked from commit cc1d19f7bbaefa5fb22ebd1344112755068b93c9) Change-Id: I56e39d9609db8fcad50ca1632ff482c1f0a30ff5
2021-04-16xmlsecurity: improve handling of multiple X509Data elementsMichael Stahl
Combine everything related to a certificate in a new struct X509Data. The CertDigest is not actually written in the X509Data element but in xades:Cert, so try to find the matching entry in XSecController::setX509CertDigest(). There was a confusing interaction with PGP signatures, where ouGpgKeyID was used for import, but export wrote the value from ouCertDigest instead - this needed fixing. The main point of this is enforcing a constraint from xmldsig-core 4.5.4: All certificates appearing in an X509Data element MUST relate to the validation key by either containing it or being part of a certification chain that terminates in a certificate containing the validation key. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111254 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 9e82509b09f5fe2eb77bcdb8fd193c71923abb67) xmlsecurity: improve handling of multiple certificates per X509Data It turns out that an X509Data element can contain an arbitrary number of each of its child elements. How exactly certificates of an issuer chain may or should be distributed across multiple X509Data elements isn't terribly obvious. One thing that is clear is that any element that refers to or contains one particular certificate has to be a child of the same X509Data element, although in no particular order, so try to match the 2 such elements that the parser supports in XSecController::setX509Data(). Presumably the only way it makes sense to have multiple signing certificates is if they all contain the same key but are signed by different CAs. This case isn't handled currently; CheckX509Data() will complain there's not a single chain and validation of the certificates will fail. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111500 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 5af5ea893bcb8a8eb472ac11133da10e5a604e66) xmlsecurity: add EqualDistinguishedNames() Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111545 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 1d3da3486d827dd5e7a3bf1c7a533f5aa9860e42) xmlsecurity: avoid exception in DigitalSignaturesDialog::getCertificate() Fallback to PGP if there's no X509 signing certificate because CheckX509Data() failed prevents the dialog from popping up. To avoid confusing the user in this situation, the dialog should show no certificate, which is already the case. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111664 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 90b725675c2964f4a151d802d9afedd8bc2ae1a7) xmlsecurity: fix crash in DocumentDigitalSignatures::isAuthorTrusted() If the argument is null. This function also should use EqualDistinguishedNames(). Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111667 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit ca98e505cd69bf95d8ddb9387cf3f8e03ae4577d) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111910 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit a1cf770c2d7ca3e153e0b1f01ddcc313bc2bed7f) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/113058 Tested-by: Michael Stahl <michael.stahl@allotropia.de> Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> Change-Id: I9633a980b0c18d58dfce24fc59396a833498a77d
2021-04-16clang-format ooxmlsecexporter.cxxMichael Stahl
Change-Id: I3faa33c98ec56197a1528f443c3850c70e171c4b
2021-04-15xmlsecurity: ignore elements in ds:Object that aren't signedMichael Stahl
Change-Id: I2e4411f0907b89e7ad6e0185cee8f12b600515e8 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111253 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 2bfa00e6bf4b2a310a8b8f5060acec85b5f7a3ce) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111909 Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 94ce59dd02fcfcaa1eb4f195b45a9a2edbd58242)
2021-04-15xmlsecurity: XSecParser confused about multiple timestampsMichael Stahl
LO writes timestamp both to dc:date and xades:SigningTime elements. The parser tries to avoid reading multiple dc:date, preferring the first one, but doesn't care about multiple xades:SigningTime, for undocumented reasons. Ideally something should check all read values for consistency. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111160 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 4ab8d9c09a5873ca0aea56dafa1ab34758d52ef7) xmlsecurity: remove XSecController::setPropertyId() Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111252 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit d2a345e1163616fe3201ef1d6c758e2e819214e0) Change-Id: Ic018ee89797a1c8a4f870ae102af48006de930ef Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111908 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit abe77c4fcb9ea97d9fff07eaea6d8863bcba5b02)
2021-04-15xmlsecurity: replace XSecParser implementationMichael Stahl
Implement Namespaces in XML and follow xmldsig-core and XAdES schemas. Reviewed-on: https://gerrit.libreoffice.org/c/core/+/110833 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 12b15be8f4f930a04d8056b9219ac969b42a9784) xmlsecurity: move XSecParser state into contexts Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111158 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit 59df9e70ce1a7ec797b836bda7f9642912febc53) xmlsecurity: move XSecParser Reference state into contexts Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111159 Tested-by: Jenkins Reviewed-by: Michael Stahl <michael.stahl@allotropia.de> (cherry picked from commit cfeb89a758b5f0ec406f0d72444e52ed2f47b85e) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/111907 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit ad5930e87e788780a255523f106deb1dde5d7b37) Change-Id: I03537b51bb757ecbfa63a826b38de543c70ba032
2021-04-15expand out some namespace aliases [xmlsecurity/source/helper]Noel Grandin
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/94093 Tested-by: Jenkins Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk> (cherry picked from commit 943fbfad668da76f7d0ebd4f4d8cdd67224d2f01) plus one line in xsecverify.cxx from: commit f59d9e7ea09482c2e9e5f52a8d0445e4cebc3df5 Author: Noel Grandin <noel.grandin@collabora.co.uk> AuthorDate: Fri Apr 3 15:53:49 2020 +0200 new loplugin:unusedvariableplus a particularly aggressive checker, which is why it is off by default Change-Id: I5fdb554a1b116824843f35645bc1cea3ca91e0f2
2021-04-15tdf#42316 always evaluate macro signatures on loadJan-Marek Glogowski
As already stated in the comments of the signing unit tests, disabling macro security will not only ignore the signatures, but actually drop the macro signature, as these are never evaluated and as a result can't be restored for the new document. Change-Id: Ie41a9e72d3367c2eed58a52387bb67d8c41abff3 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/90435 Tested-by: Jenkins Reviewed-by: Thorsten Behrens <Thorsten.Behrens@CIB.de> (cherry picked from commit 929d46bbf42aefc1f6cf046c2b9cf3d7c4e1efc5) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/90393 Tested-by: Thorsten Behrens <Thorsten.Behrens@CIB.de>
2021-04-15Fix macro security UI usability problemsJan-Marek Glogowski
* Don't hide the option dialogs "Macro security" push button. I don't see any reason, why these settings should be hidden, if macros are disabled or settings locked. At least a user can now check, what is going on (still nothing shows disabled macros for a document in the UI AFAIK). * Don't scale the lock icons of the trusted list boxes. This just uses the same alignments, which the macro security level lock image uses, otherwise the image is scaled to fit the whole space of its layout cell. * Don't disable the trusted list boxes. If the setting is locked, it's sufficient to disable all the buttons, which allow modification (so View can stay enabled). This way you can still scroll the list. Correct button handling is already implemented and works for me. * Catch exceptions of broken certificate data. If your config contains certificates, which can't be correctly decoded, the NSS backend will throw an exception, which kills the dialog, but not the nested loop, resulting in a locked LO. Since we don't want a string change in LTS, this drops the whole "broken certificate" warning dialog. There already are SAL_WARNs, which log the same warning, and are considered sufficient for debugging broken configurations. Reviewed-on: https://gerrit.libreoffice.org/85056 Tested-by: Jenkins Reviewed-by: Jan-Marek Glogowski <glogow@fbihome.de> (cherry picked from commit b3348ce498b3d54b3e5e6518954ad9d5e917b8f2) Reviewed-on: https://gerrit.libreoffice.org/85282 (cherry picked from commit ad1a41032054991cfb8b9e821c1dd25ec21d0aec) Conflicts: xmlsecurity/source/dialogs/macrosecurity.cxx Change-Id: I79002e0ce85cf9a9017caf858407f2f635a3a074 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/85756 Reviewed-by: Thorsten Behrens <Thorsten.Behrens@CIB.de> Tested-by: Thorsten Behrens <Thorsten.Behrens@CIB.de>
2021-04-15tdf#42316 handle saving to template filtersJan-Marek Glogowski
This extends the filter comparison from commit c3a1c83ff5af ("tdf#42316 preserve macro signature of templates"). The original patch just stripped "_template" from the source filter to find equal document types, which just enables the "template => document" case. This patch also strips the "_template" from the target filter, which fixes the "document or template => template" cases. This also extends the signing save tests: * OTT 1.2 => OTT 1.2 - preserve * ODT 1.2 => OTT 1.2 - preserve * OTT 1.0 => OTT 1.0 - preserve * ODT 1.0 => OTT 1.0 - preserve * OTT 1.0 => OTT 1.2 - drop Reviewed-on: https://gerrit.libreoffice.org/80654 Tested-by: Jenkins Reviewed-by: Samuel Mehrbrodt <Samuel.Mehrbrodt@cib.de> (cherry picked from commit 4aa6e2cb2245eddab87fb451add94159a7604246) Reviewed-on: https://gerrit.libreoffice.org/80910 Reviewed-by: Michael Stahl <michael.stahl@cib.de> (cherry picked from commit 7b405877b0fa0145513ac0294ab51cf57e6108c6) Change-Id: Ie297258a4d9f9aa4beb25786c6ba240b6f16f49b Reviewed-on: https://gerrit.libreoffice.org/81885 Reviewed-by: Thorsten Behrens <Thorsten.Behrens@CIB.de> Tested-by: Thorsten Behrens <Thorsten.Behrens@CIB.de>
2021-04-15tdf#42316 preserve macro signature of templatesJan-Marek Glogowski
When comparing the filter of the current and the target document we have to strip the '_template' from the filter name. Still this won't preserve the signature of the document attached to tdf#42316, as this is a ODF 1.0 OTT, which doesn't have a valid signature in ODF 1.2, as the signature doesn't match the ODF 1.2 namespace for signatures and the default LO ODF version is ODF 1.2 extended. In theory the signature itself could even be converted most times, but that can be done in an additional patch, if needed. Since the code literally saves a template to an internal document, SfxObjectShell::DoSaveCompleted must keep the signature of the template. Eventually it'll be dropped on save of the template as a document later. The signing tests check "OTT 1.0 => ODT 1.0: preserve", "OTT 1.2 => ODT 1.2: preserve" and "OTT 1.0 => ODT 1.2: drop". Reviewed-on: https://gerrit.libreoffice.org/75958 Tested-by: Jenkins Reviewed-by: Michael Stahl <Michael.Stahl@cib.de> Reviewed-by: Thorsten Behrens <Thorsten.Behrens@CIB.de> (cherry picked from commit c3a1c83ff5af05d34f433ac808adbe85f47e8c18) Reviewed-on: https://gerrit.libreoffice.org/77112 Conflicts: xmlsecurity/qa/unit/signing/signing.cxx Change-Id: I2263093687f5a0568ea781ce3ac9b114c9599add Reviewed-on: https://gerrit.libreoffice.org/79371 Reviewed-by: Thorsten Behrens <Thorsten.Behrens@CIB.de> Tested-by: Thorsten Behrens <Thorsten.Behrens@CIB.de>
2021-04-15[API CHANGE] extend css.security.XDocumentDigitalSignaturesbrinzing
Add support for macro and package signing with a provided certificate which is already possible for document signing since LO 6.2: boolean signScriptingContentWithCertificate( [in] ::com::sun::star::security::XCertificate xCertificate, [in] ::com::sun::star::embed::XStorage xStorage, [in] ::com::sun::star::io::XStream xStream); boolean signPackageWithCertificate( [in] ::com::sun::star::security::XCertificate xCertificate, [in] ::com::sun::star::embed::XStorage xStorage, [in] ::com::sun::star::io::XStream xStream); Change-Id: I9783cd317a7202691913be186eca95964b1e0ff7 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/86141 Tested-by: Jenkins Reviewed-by: Thorsten Behrens <Thorsten.Behrens@CIB.de> (cherry picked from commit 697989d11e25b3eb83e5ca2dad5d71b178abfbc1) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/107772 Tested-by: Thorsten Behrens <Thorsten.Behrens@CIB.de>
2021-04-15tdf#42949 Fix IWYU warnings in xmlsecurity/*cxxGabor Kelemen
Found with bin/find-unneeded-includes Only removal proposals are dealt with here. Change-Id: I89c77656ea4021cb16bd122cb1dd1cd803390c3d Reviewed-on: https://gerrit.libreoffice.org/71765 Tested-by: Jenkins Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
2021-04-15tdf#42949 Fix IWYU warnings in xmlsecurity/*hxxGabor Kelemen
Found with bin/find-unneeded-includes Only removal proposals are dealt with here. All hxx cleaned except the ones in xmlsecurity/source/xmlsec/mscrypt Change-Id: I651f53c9d339208b3132f9078a5c3829ff9c5dc8 Reviewed-on: https://gerrit.libreoffice.org/71448 Tested-by: Jenkins Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
2021-04-13tdf#123747 xmlsecurity, ODF sign roundtrip: preserve invalid reference typeMiklos Vajna
Only add the correct type to new signatures to avoid breaking the hash of old ones. Change-Id: I30f892b292f84a0575a3d4ef5ccf3eddbe0090ca Reviewed-on: https://gerrit.libreoffice.org/70424 Tested-by: Jenkins Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
2021-04-13default to CertificateValidity::INVALIDCaolán McNamara
so if CertGetCertificateChain fails we don't want validity to be css::security::CertificateValidity::VALID which is what the old default of 0 equates to notably commit 1e0bc66d16aee28ce8bd9582ea32178c63841902 Date: Thu Nov 5 16:55:26 2009 +0100 jl137: #103420# better logging turned the nss equivalent of SecurityEnvironment_NssImpl::verifyCertificate from 0 to CertificateValidity::INVALID like this change does Change-Id: I5350dbc22d1b9b378da2976d3b0abd728f1f4c27 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/110561 Tested-by: Jenkins Reviewed-by: Miklos Vajna <vmiklos@collabora.com> (cherry picked from commit edeb164c1d8ab64116afee4e2140403a362a1358) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/113090 Tested-by: Michael Stahl <michael.stahl@allotropia.de> Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
2021-04-13xmlsecurity: reject a few dangerous annotation types during pdf sig verifyMiklos Vajna
(cherry picked from commit f231dacde9df1c4aa5f4e0970535c4f4093364a7) Conflicts: xmlsecurity/source/helper/pdfsignaturehelper.cxx Reviewed-on: https://gerrit.libreoffice.org/c/core/+/105926 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit fcab45e0e22f4cf46e71856dba7ae5abd6f99bc5) Change-Id: I950b49a6e7181639daf27348ddfa0f36586baa65 Conflicts: xmlsecurity/qa/unit/pdfsigning/pdfsigning.cxx (cherry-picked from 363997c76749219b900f47043d1b17ba8ec9bccd) Change-Id: I7096222bc2547046d988e0ba28df725859270790
2021-04-07xmlsecurity: handle MDP permission during PDF verifyMiklos Vajna
(cherry picked from commit 586f6abee92af3cdabdce034b607b9a046ed3946) Conflicts: include/vcl/filter/PDFiumLibrary.hxx vcl/source/pdf/PDFiumLibrary.cxx xmlsecurity/source/helper/pdfsignaturehelper.cxx Reviewed-on: https://gerrit.libreoffice.org/c/core/+/105785 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 00479937dc071246cc27f33fd6397668448a7ed9) Change-Id: I626fca7c03079fb0374c577dcfe024e7db6ed5b3 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/107085 Tested-by: Michael Stahl <michael.stahl@cib.de> Reviewed-by: Michael Stahl <michael.stahl@cib.de>
2021-04-07xmlsecurity: pdf incremental updates that are non-commenting are invalidMiklos Vajna
I.e. it's OK to add incremental updates for annotation/commenting purposes and that doesn't invalite existing signatures. Everything else does. (cherry picked from commit 61834cd574568613f0b0a2ee099a60fa5a8d9804) Conflicts: include/vcl/filter/PDFiumLibrary.hxx vcl/source/pdf/PDFiumLibrary.cxx xmlsecurity/qa/unit/signing/signing.cxx Change-Id: I4607c242b3c6f6b01517b02407e9e7a095e2e069
2021-04-06xmlsecurity: detect unsigned incremental update between signaturesMiklos Vajna
(cherry picked from commit 7468d5df5ec79783eae84b62bdc5ecf12f0ca255) Conflicts: vcl/source/filter/ipdf/pdfdocument.cxx xmlsecurity/source/pdfio/pdfdocument.cxx Change-Id: I269ed858852ee7d1275adf340c8cc1565fc30693 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/99480 Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com> Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
2021-04-06xmlsecurity: avoid saying OK when the signature is partialMiklos Vajna
That's reserved for valid signatures (digest match, certificate validates and the signature covers the whole document). Also avoid "invalid" in the dialog when the digest matches and the signature is just incomplete. This now uses wording which is closer to Acrobat and also uses the same wording on the infobar and in the dialog. Conflicts: xmlsecurity/source/dialogs/digitalsignaturesdialog.cxx Change-Id: I26e4781d555b65cf29aa8df2232e286917235dc1 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/101926 Reviewed-by: Miklos Vajna <vmiklos@collabora.com> Tested-by: Jenkins Reviewed-on: https://gerrit.libreoffice.org/c/core/+/102188 Reviewed-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 46efad443472679b93b282c8e08b807d7e8f1a78)
2021-04-06xmlsecurity: fix infobar vs signature dialog inconsistencyMiklos Vajna
The infobar mentioned if a signature is partial, but the dialog just has a bool UI for signatures. Then present "good, but partial" as "bad". (cherry picked from commit 3ba1144cb96c710e665ffb3ada26fb6a48a03472) Change-Id: I698190aa77702000b11d635bd038d9c9a91614ac Reviewed-on: https://gerrit.libreoffice.org/c/core/+/101844 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com>
2019-08-13tdf#116085 add more Gpg4Win binary locationsThorsten Behrens
Seems Gpg4Win recently grew a few more variants where to put stuff. Look there, too. Change-Id: Ifa09db11665671f518a6a66480c1a71fd619d8cd Reviewed-on: https://gerrit.libreoffice.org/77341 Tested-by: Jenkins Reviewed-by: Xisco Faulí <xiscofauli@libreoffice.org> (cherry picked from commit 536ab2f3ba1e71badaaf98db9419ca7c7ddd7ac4) Reviewed-on: https://gerrit.libreoffice.org/77421
2019-04-09tdf#123747 xmlsecurity, ODF sign roundtrip: preserve invalid reference typeMiklos Vajna
Only add the correct type to new signatures to avoid breaking the hash of old ones. (cherry picked from commit 8a9d8238bd8f903393ff1184aa37f8973c81e2ba) Conflicts: xmlsecurity/qa/unit/signing/signing.cxx Change-Id: I30f892b292f84a0575a3d4ef5ccf3eddbe0090ca Reviewed-on: https://gerrit.libreoffice.org/70451 Tested-by: Jenkins Tested-by: Xisco Faulí <xiscofauli@libreoffice.org> Reviewed-by: Michael Stahl <Michael.Stahl@cib.de>
2018-12-05tdf#118373 xmlsecurity: avoid stderr output on libxmlsec version checkMiklos Vajna
Make sure that our normal SAL_WARN() reporting is registered during the xmlSecCheckVersionExt() invocation, just like it's registered during other libxmlsec API calls. (cherry picked from commit 099ab643f60efc5be6f151bff89651efd2da1fc9) Change-Id: Ia19368b55dbae47974f48954f86b50e36d1462ff Reviewed-on: https://gerrit.libreoffice.org/64605 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> Tested-by: Caolán McNamara <caolanm@redhat.com>
2018-11-28sfx2: show partial signatures even if cert validation failsMiklos Vajna
(cherry picked from commit 4a59a8aba8c9d451edff790d9281d0095c1bd78e) Change-Id: I6060b7130827346ac5d6955bf38ebe3b476819fd Reviewed-on: https://gerrit.libreoffice.org/64151 Tested-by: Jenkins Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
2018-11-22weld SwCondCollPageCaolán McNamara
and put back original SvTreeListBox a11y factory use Change-Id: I4ad8ce29d8fed6ec5d44e9a1d641919a89226b79 Reviewed-on: https://gerrit.libreoffice.org/63501 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> Tested-by: Caolán McNamara <caolanm@redhat.com> (cherry picked from commit 47897fdd936d9b6e9ac8cb6110c79352ab080df7) Reviewed-on: https://gerrit.libreoffice.org/63770
2018-11-19weld TreeViewCaolán McNamara
a) use GtkTreeStores for GtkTreeViews b) ironically can't store GtkTreeStore contents in .ui apparently c) set show_expanders for all non-trees and unconverted cases d) on-demand subtrees Change-Id: I3c1036a222daba2c129b1a22ffeb3fe35005ae31 Reviewed-on: https://gerrit.libreoffice.org/63558 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com> Tested-by: Caolán McNamara <caolanm@redhat.com>
2018-11-17Adapt to C++2a char_tStephan Bergmann
u8 literals incompatibly change their type (as implemented by recent Clang trunk) Change-Id: Ia4f7b91f5d86656a056303d2754981ab2093a739 Reviewed-on: https://gerrit.libreoffice.org/63494 Tested-by: Jenkins Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
generated by cgit (git 2.34.1) at 2024-05-07 04:43:57 +0000