Skip to content

Commit fcdc4dd

Browse files
guustysebieEugene Bochilo
guustysebie
authored and
Eugene Bochilo
committed
Finalize LOTL API
Add support for GraalVM
1 parent 187b42c commit fcdc4dd

35 files changed

+2008
-1048
lines changed

‎pom.xml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -943,7 +943,6 @@
943943
<arg>
944944
--initialize-at-build-time=org.junit.validator.PublicClassValidator
945945
--initialize-at-build-time=org.junit.platform.engine.TestTag
946-
947946
--initialize-at-run-time=org.bouncycastle.crypto.prng.SP800SecureRandom
948947
--initialize-at-run-time=org.bouncycastle.jcajce.provider.drbg.DRBG$NonceAndIV
949948
--initialize-at-run-time=org.bouncycastle.jcajce.provider.drbg.DRBG$Default
@@ -953,6 +952,9 @@
953952
--enable-all-security-services
954953
--enable-url-protocols=http,https,ftp
955954

955+
-H:IncludeLocales=en_US
956+
-H:IncludeResourceBundles=org.apache.xml.security.resource.xmlsecurity
957+
956958
-H:+AddAllCharsets
957959
-H:ReflectionConfigurationFiles=${basedir}/../resources/graalvm/reflect-config.json
958960
<!-- Graalvm requires VisualStudio 2022 on Windows but it also works with earlier versions.

‎resources/graalvm/reflect-config.json‎

Lines changed: 149 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,6 @@
1919
"allDeclaredConstructors": true,
2020
"allDeclaredFields": true
2121
},
22-
{
23-
"name": "com.itextpdf.commons.utils.JsonUtilTest$ClassWithEnum",
24-
"allDeclaredConstructors": true,
25-
"allDeclaredFields": true
26-
},
2722
{
2823
"name": "com.itextpdf.commons.utils.JsonUtilTest$SomeEnum",
2924
"allDeclaredConstructors": true,
@@ -53,5 +48,154 @@
5348
"name": "com.itextpdf.styledxmlparser.jsoup.parser.HtmlTreeBuilderState$Constants",
5449
"allDeclaredConstructors": true,
5550
"allDeclaredFields": true
51+
},
52+
{
53+
"name": "com.sun.org.apache.xpath.internal.functions.FuncNormalizeSpace",
54+
"methods": [
55+
{
56+
"name": "<init>",
57+
"parameterTypes": []
58+
}
59+
]
60+
},
61+
{
62+
"name": "org.apache.xml.security.algorithms.implementations.SignatureBaseRSA$SignatureRSASHA256",
63+
"allDeclaredConstructors": true
64+
},
65+
{
66+
"name": "org.apache.xml.security.algorithms.implementations.SignatureBaseRSA$SignatureRSASHA512",
67+
"allDeclaredConstructors": true
68+
},
69+
{
70+
"name": "org.apache.xml.security.c14n.implementations.Canonicalizer20010315ExclOmitComments",
71+
"allDeclaredConstructors": true
72+
},
73+
{
74+
"name": "org.apache.xml.security.algorithms.implementations.SignatureBaseRSA$SignatureRSASHA1",
75+
"allDeclaredConstructors": true
76+
},
77+
{
78+
"name": "org.apache.xml.security.algorithms.implementations.SignatureBaseRSA$SignatureRSASHA384",
79+
"allDeclaredConstructors": true
80+
},
81+
{
82+
"name": "org.apache.xml.security.algorithms.implementations.SignatureBaseRSA$SignatureRSAMD5",
83+
"allDeclaredConstructors": true
84+
},
85+
{
86+
"name": "org.apache.xml.security.algorithms.implementations.SignatureECDSA",
87+
"allDeclaredConstructors": true
88+
},
89+
{
90+
"name": "org.apache.xml.security.algorithms.implementations.SignatureDSA",
91+
"allDeclaredConstructors": true
92+
},
93+
{
94+
"name": "org.apache.xml.security.c14n.implementations.Canonicalizer20010315OmitComments",
95+
"allDeclaredConstructors": true
96+
},
97+
{
98+
"name": "org.apache.xml.security.c14n.implementations.Canonicalizer20010315WithComments",
99+
"allDeclaredConstructors": true
100+
},
101+
{
102+
"name": "org.apache.xml.security.c14n.implementations.Canonicalizer20010315ExclWithComments",
103+
"allDeclaredConstructors": true
104+
},
105+
{
106+
"name": "org.apache.xml.security.algorithms.implementations.SignatureBaseRSA$SignatureRSASHA1MGF1",
107+
"allDeclaredConstructors": true
108+
},
109+
{
110+
"name": "org.apache.xml.security.algorithms.implementations.SignatureBaseRSA$SignatureRSASHA224MGF1",
111+
"allDeclaredConstructors": true
112+
},
113+
{
114+
"name": "org.apache.xml.security.algorithms.implementations.SignatureBaseRSA$SignatureRSASHA256MGF1",
115+
"allDeclaredConstructors": true
116+
},
117+
{
118+
"name": "org.apache.xml.security.algorithms.implementations.SignatureBaseRSA$SignatureRSASHA384MGF1",
119+
"allDeclaredConstructors": true
120+
},
121+
{
122+
"name": "org.apache.xml.security.algorithms.implementations.SignatureBaseRSA$SignatureRSASHA512MGF1",
123+
"allDeclaredConstructors": true
124+
},
125+
{
126+
"name": "org.apache.xml.security.algorithms.implementations.SignatureECDSA$SignatureECDSASHA1",
127+
"allDeclaredConstructors": true
128+
},
129+
{
130+
"name": "org.apache.xml.security.algorithms.implementations.SignatureECDSA$SignatureECDSASHA224",
131+
"allDeclaredConstructors": true
132+
},
133+
{
134+
"name": "org.apache.xml.security.algorithms.implementations.SignatureECDSA$SignatureECDSASHA256",
135+
"allDeclaredConstructors": true
136+
},
137+
{
138+
"name": "org.apache.xml.security.algorithms.implementations.SignatureECDSA$SignatureECDSASHA384",
139+
"allDeclaredConstructors": true
140+
},
141+
{
142+
"name": "org.apache.xml.security.algorithms.implementations.SignatureECDSA$SignatureECDSASHA512",
143+
"allDeclaredConstructors": true
144+
},
145+
{
146+
"name": "org.apache.xml.security.algorithms.implementations.SignatureBaseRSA$SignatureRSASHA224",
147+
"allDeclaredConstructors": true
148+
},
149+
{
150+
"name": "org.apache.xml.security.algorithms.implementations.SignatureHMAC",
151+
"allDeclaredConstructors": true
152+
},
153+
{
154+
"name": "org.apache.xml.security.algorithms.implementations.SignatureHMAC$SignatureHMACSHA1",
155+
"allDeclaredConstructors": true
156+
},
157+
{
158+
"name": "org.apache.xml.security.algorithms.implementations.SignatureHMAC$SignatureHMACSHA256",
159+
"allDeclaredConstructors": true
160+
},
161+
{
162+
"name": "org.apache.xml.security.algorithms.implementations.SignatureHMAC$SignatureHMACSHA384",
163+
"allDeclaredConstructors": true
164+
},
165+
{
166+
"name": "org.apache.xml.security.algorithms.implementations.SignatureHMAC$SignatureHMACSHA512",
167+
"allDeclaredConstructors": true
168+
},
169+
{
170+
"name": "org.apache.xml.security.transforms.implementations.TransformEnvelopedSignature",
171+
"allDeclaredConstructors": true
172+
},
173+
{
174+
"name": "org.apache.xml.security.transforms.implementations.TransformXPath",
175+
"allDeclaredConstructors": true
176+
},
177+
{
178+
"name": "org.apache.xml.security.transforms.implementations.TransformBase64",
179+
"allDeclaredConstructors": true
180+
},
181+
{
182+
"name": "org.apache.xml.security.transforms.implementations.TransformC14NExclusive",
183+
"allDeclaredConstructors": true
184+
},
185+
{
186+
"name": "org.apache.xml.security.transforms.implementations.TransformC14NInclusive",
187+
"allDeclaredConstructors": true
188+
},
189+
{
190+
"name": "org.apache.xml.security.encryption.XMLCipher",
191+
"allDeclaredConstructors": true
192+
},
193+
{
194+
"name": "org.apache.xml.security.encryption.EncryptedKey",
195+
"allDeclaredConstructors": true
196+
},
197+
{
198+
"name": "org.apache.xml.security.Init",
199+
"allDeclaredConstructors": true
56200
}
57201
]

‎sign/src/main/java/com/itextpdf/signatures/exceptions/SignExceptionMessageConstant.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -127,21 +127,21 @@ public final class SignExceptionMessageConstant {
127127
"and 'addSchemaNameToIgnore' methods. " + "either provide specific countries to process, or provide " +
128128
"specific countries to ignore (All " + "countries not ignored will be processed). ";
129129
public static final String STALE_DATA_IS_USED = "Cached data is older then configured staleness. This means that "
130-
+ "the cache has failed to update automatically for the configured period " + "Please refresh using " +
131-
"LotlService#intializeCache, or look into the generated log messages for more " + "details" + " why the " +
130+
+ "the cache has failed to update automatically for the configured period. Please, refresh using " +
131+
"LotlService#intializeCache, or look into the generated log messages for more details on why the " +
132132
"cache has not been updated.";
133133
public static final String STALENESS_MUST_BE_POSITIVE = "Staleness must be a positive value. " + "It is used to " +
134134
"determine how long the cache is valid before it needs to be refreshed.";
135135
public static final String FAILED_TO_FETCH_LOTL_FOR_COUNTRY =
136136
"Failed to fetch Lotl for country {0} from {1}. " + "Report {2}";
137137
public static final String CACHE_NOT_INITIALIZED = "Lotl cache has not been initialized. " + "Please call " +
138-
"LotlFetchingProperties#initializeCache before using LotlValidator.\n" + "If you are using a custom Lotl " +
139-
"service, " + "please make sure to call #initializeCache on your custom implementation.";
138+
"LotlService#initializeGlobalCache if European LOTLs are trusted.\nIf you are using a custom LotlService, "
139+
+ "please make sure to call LotlService#initializeCache on your custom implementation.";
140140
public static final String FAILED_TO_FETCH_EU_JOURNAL_CERTIFICATES = "Problem occurred while fetching " + "EU " +
141141
"Journal certificates.\n{0}";
142-
public static final String CACHE_ALREADY_INITIALIZED = "Global Lotl service has already been initialized. " +
142+
public static final String CACHE_ALREADY_INITIALIZED = "Global LOTL service has already been initialized. " +
143143
"You cannot initialize it again. If you want to use a different configuration, please create a new " +
144-
"instance " + "of LotlService with the desired properties and use this one in the LotlValidator.";
144+
"instance of LotlService with the desired properties and use it in ValidatorChainBuilder.";
145145

146146
private SignExceptionMessageConstant() {
147147
// Private constructor will prevent the instantiation of this class directly

‎sign/src/main/java/com/itextpdf/signatures/validation/CertificateChainValidator.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ protected CertificateChainValidator(ValidatorChainBuilder builder) {
8989
this.certificateRetriever = builder.getCertificateRetriever();
9090
this.properties = builder.getProperties();
9191
this.revocationDataValidator = builder.getRevocationDataValidator();
92-
this.lotlTrustedStore = builder.getLotlTrustedstore();
92+
this.lotlTrustedStore = builder.getLotlTrustedStore();
9393
}
9494

9595
/**
@@ -161,8 +161,8 @@ private boolean checkIfCertIsTrusted(ValidationReport result, ValidationContext
161161
}
162162

163163
private boolean stopValidation(ValidationReport result, ValidationContext context) {
164-
return !properties.getContinueAfterFailure(context)
165-
&& result.getValidationResult() == ValidationReport.ValidationResult.INVALID;
164+
return result.getValidationResult() == ValidationResult.INVALID &&
165+
!properties.getContinueAfterFailure(context);
166166
}
167167

168168
private void validateValidityPeriod(ValidationReport result, X509Certificate certificate,

‎sign/src/main/java/com/itextpdf/signatures/validation/SafeCalling.java‎

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,13 @@ This file is part of the iText (R) project.
3131
import java.util.function.Function;
3232
import java.util.function.Supplier;
3333

34-
final class SafeCalling {
34+
/**
35+
* Utility class to handle exceptions and generate validation report items instead.
36+
*/
37+
public final class SafeCalling {
3538

36-
private SafeCalling() {}
39+
private SafeCalling() {
40+
}
3741

3842
/**
3943
* Adds a report item to the report when an exception is thrown in the action.
@@ -43,9 +47,11 @@ private SafeCalling() {}
4347
* @param reportItemCreator A callback to generate a ReportItem
4448
*/
4549
public static void onExceptionLog(ThrowingAction action, ValidationReport report,
46-
Function<Exception, ReportItem> reportItemCreator) {
50+
Function<Exception, ReportItem> reportItemCreator) {
4751
try {
4852
action.execute();
53+
} catch (SafeCallingAvoidantException e) {
54+
throw e;
4955
} catch (Exception e) {
5056
report.addReportItem(reportItemCreator.apply(e));
5157
}
@@ -58,14 +64,16 @@ public static void onExceptionLog(ThrowingAction action, ValidationReport report
5864
* @param defaultValue The value to return when an exception is thrown
5965
* @param report The report to add the ReportItem to
6066
* @param reportItemCreator A callback to generate a ReportItem
61-
* @param <T>
67+
* @param <T> type of return value
6268
*
6369
* @return The returned value from the action
6470
*/
6571
public static <T> T onExceptionLog(ThrowingSupplier<T> action, T defaultValue, ValidationReport report,
66-
Function<Exception, ReportItem> reportItemCreator) {
72+
Function<Exception, ReportItem> reportItemCreator) {
6773
try {
6874
return action.get();
75+
} catch (SafeCallingAvoidantException e) {
76+
throw e;
6977
} catch (Exception e) {
7078
report.addReportItem(reportItemCreator.apply(e));
7179
}
@@ -80,9 +88,11 @@ public static <T> T onExceptionLog(ThrowingSupplier<T> action, T defaultValue, V
8088
* @param reportItemCreator A callback to generate a ReportItem
8189
*/
8290
public static void onRuntimeExceptionLog(Action action, ValidationReport report,
83-
Function<Exception, ReportItem> reportItemCreator) {
91+
Function<Exception, ReportItem> reportItemCreator) {
8492
try {
8593
action.execute();
94+
} catch (SafeCallingAvoidantException e) {
95+
throw e;
8696
} catch (RuntimeException e) {
8797
report.addReportItem(reportItemCreator.apply(e));
8898
}
@@ -95,14 +105,16 @@ public static void onRuntimeExceptionLog(Action action, ValidationReport report,
95105
* @param defaultValue The value to return when an exception is thrown
96106
* @param report The report to add the ReportItem to
97107
* @param reportItemCreator A callback to generate a ReportItem
98-
* @param <T>
108+
* @param <T> type of return value
99109
*
100110
* @return The returned value from the action
101111
*/
102112
public static <T> T onRuntimeExceptionLog(Supplier<T> action, T defaultValue, ValidationReport report,
103-
Function<Exception, ReportItem> reportItemCreator) {
113+
Function<Exception, ReportItem> reportItemCreator) {
104114
try {
105115
return action.get();
116+
} catch (SafeCallingAvoidantException e) {
117+
throw e;
106118
} catch (RuntimeException e) {
107119
report.addReportItem(reportItemCreator.apply(e));
108120
}

‎sign/src/main/java/com/itextpdf/signatures/validation/SafeCallingAvoidantException.java‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
/*
2+
This file is part of the iText (R) project.
3+
Copyright (c) 1998-2025 Apryse Group NV
4+
Authors: Apryse Software.
5+
6+
This program is offered under a commercial and under the AGPL license.
7+
For commercial licensing, contact us at https://itextpdf.com/sales. For AGPL licensing, see below.
8+
9+
AGPL licensing:
10+
This program is free software: you can redistribute it and/or modify
11+
it under the terms of the GNU Affero General Public License as published by
12+
the Free Software Foundation, either version 3 of the License, or
13+
(at your option) any later version.
14+
15+
This program is distributed in the hope that it will be useful,
16+
but WITHOUT ANY WARRANTY; without even the implied warranty of
17+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18+
GNU Affero General Public License for more details.
19+
20+
You should have received a copy of the GNU Affero General Public License
21+
along with this program. If not, see <https://www.gnu.org/licenses/>.
22+
*/
23+
package com.itextpdf.signatures.validation;
24+
25+
import com.itextpdf.kernel.exceptions.PdfException;
26+
27+
/**
28+
* In some cases we need to propagate the exception without @{link SafeCalling} mechanism converting it to
29+
* report items.
30+
* This exception is used to indicate that something actually went wrong and not only the validation report is Invalid,
31+
* but an underlying process might be affected.
32+
*/
33+
public class SafeCallingAvoidantException extends PdfException {
34+
35+
/**
36+
* Creates a new instance of {@link SafeCallingAvoidantException} with the specified detail message.
37+
*
38+
* @param message the detail message
39+
*/
40+
public SafeCallingAvoidantException(String message) {
41+
super(message);
42+
}
43+
44+
45+
/**
46+
* Creates a new instance of {@link SafeCallingAvoidantException} with the specified detail message
47+
*
48+
* @param message the detail message.
49+
* @param obj an object for more details.
50+
*/
51+
public SafeCallingAvoidantException(String message, Object obj) {
52+
this(message);
53+
this.object = obj;
54+
}
55+
56+
}

0 commit comments

Comments
 (0)