Apache Santuario
- Home
- Download
- Security Advisories
- FAQ
- Team
- Contributing
- Mailing Lists
- Issue Tracking
- History
- Old News
Apache XML Security for Java
- Index
- Download
- Release Notes
- FAQ
- API
- Interoperability
Table of Contents |
---|
...
The logging is configured in the config.xml file which either in the xmlsec.jar file or in the class path. This is a little bit complicated as config.xml is used both for library wide configurations like algorithms as well as for the user setting about log4j. This will be changed someday )
In the config.xml file, there is an element called <log4j:configuration>. This element contains the XML style configuration information as defined in the log4j DOMConfigurator classApache Santuario XML Security for Java uses Apache Commons Logging. For more information see here.
...
Example: Imagine that you want to create a signature to store it on a web server as http://www.acme.com/signatures/sig1.xml. So BaseURI="http://www.acme.com/sig1.xml". This means that if you create a Reference with URI="./index.html", the library can easily use it's HTTPResourceResolver to fetch http://www.acme.com/index.html
without that you have to say URI="http://www.acme.com/index.html".
...
Of course, there are cross-dependencies: e.g. a KeyResolver named RetrievalMethodResolver uses the ResourceResolver framework to retrieve a public key or certificate from an arbitrary location.
A property was added in the 1.5.0 release to enable "secure validation". This property is true by default from the 2.3.0 release, but false for earlier releases. When set to true, it enforces the following processing rules:
This functionality is supported in the core library through additional method signatures which take a boolean, and in the JSR-105 API via the property "org.apache.jcp.xml.dsig.secureValidation, e.g.:
Code Block | ||||
---|---|---|---|---|
| ||||
XMLValidateContext context = new DOMValidateContext(key, elem);
context.setProperty("org.apache.jcp.xml.dsig.secureValidation", Boolean.TRUE); |
Warning |
---|
Secure Validation should be enabled in production as otherwise various attacks might be possible |