XML document can be signed to ensure data integrity and authentication. The signature should be verified and validated to make sure it’s secure.
For instance, signatures based on weak cipher algorithms like MD5 should be rejected, and an XML document should not contain hostile constructs that
can lead to Denial of Services attacks, like a large number of SignedInfo elements.
Noncompliant Code Example
The Java XML Digital Signature API doesn’t use a strong signature validation mode by default:
DOMValidateContext valContext = new DOMValidateContext(new KeyValueKeySelector(), nl.item(0)); // Noncompliant
Compliant Solution
The Java XML Digital Signature API offers a secure validation mode to protect against various security
issues:
DOMValidateContext valContext = new DOMValidateContext(new KeyValueKeySelector(), nl.item(0));
valContext.setProperty("org.jcp.xml.dsig.secureValidation", Boolean.TRUE);
See
