naruto-lgtm opened a new pull request, #1510: URL: https://github.com/apache/poi/pull/1510
SignaturePart.hasSignedRelationships treats relationships whose type a signature names in a RelationshipsGroupReference as covered, but RelationshipTransformService only reads RelationshipReference/@SourceId, so relationships selected by type (ECMA-376 Part 2, 13.2.4.24) never reach the digest and one of that type added after signing, such as an external attachedTemplate link in word/_rels/document.xml.rels, leaves verifySignature() returning true. The transform now parses, marshals and applies SourceType next to SourceId; output for signatures without group references is unchanged and the existing signed samples still verify. testRelationshipsGroupReference signs hello-world-unsigned.docx with a group reference for attachedTemplate and adds one afterwards, and the resulting file verifies as valid before this change and invalid after it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
