naruto-lgtm opened a new pull request, #1511:
URL: https://github.com/apache/poi/pull/1511
Repro: take hello-world-signed.docx and add TargetMode="" to the signed
styles relationship in word/_rels/document.xml.rels. XWPFDocument loads without
its styles part, getStyles() returns null, and SignatureInfo.verifySignature()
still returns true. The same edit drops any signed part that is reached through
a relationship, a header, the footnotes or a sheet.
Cause: RelationshipTransformService.transform adds TargetMode="Internal"
when getAttribute("TargetMode") is empty, and DOM returns the empty string for
an absent attribute and for TargetMode="" alike, so the digest is the one
computed at signing time. PackageRelationshipCollection reads a present
attribute with any value other than Internal as an external relationship, and
POIXMLDocumentPart.read only follows internal ones, so verification and the
package model disagree on which parts the signature covers (CWE-347).
Fix: add the default only when the attribute is absent, which is what the
Relationships Transform Algorithm in ECMA-376 Part 2 (13.2.4.24) describes.
Relationships without the attribute or with an explicit value digest exactly as
before and all signed samples in test-data still verify. The new test in
TestSignatureInfo fails before the change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
