import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
/**
 * Validate an instance of {@link SignatureImpl}, which is in turn based on underlying Apache XML Security
 * <code>XMLSignature</code> instance.
 * 
 * @param sigImpl the signature implementation object to validate
 * @throws ValidationException thrown if the signature is not valid with respect to the profile
 */
protected void validateSignatureImpl(SignatureImpl sigImpl) throws ValidationException {

    if (sigImpl.getXMLSignature() == null) {
        log.error("SignatureImpl did not contain the an Apache XMLSignature child");
        throw new ValidationException("Apache XMLSignature does not exist on SignatureImpl");
    }
    XMLSignature apacheSig = sigImpl.getXMLSignature();

    if (!(sigImpl.getParent() instanceof SignableSAMLObject)) {
        log.error("Signature is not an immedidate child of a SignableSAMLObject");
        throw new ValidationException("Signature is not an immediate child of a SignableSAMLObject.");
    }
    SignableSAMLObject signableObject = (SignableSAMLObject) sigImpl.getParent();

    Reference ref = validateReference(apacheSig);

    String uri = ref.getURI();
    
    validateReferenceURI(uri, signableObject);

    validateTransforms(ref);
    
    validateObjectChildren(apacheSig);
}
 

import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
/**
 * Validate the Signature's SignedInfo Reference.
 * 
 * The SignedInfo must contain exactly 1 Reference.
 * 
 * @param apacheSig the Apache XML Signature instance
 * @return the valid Reference contained within the SignedInfo
 * @throws ValidationException thrown if the Signature does not contain exactly 1 Reference, or if there is an error
 *             obtaining the Reference instance
 */
protected Reference validateReference(XMLSignature apacheSig) throws ValidationException {
    int numReferences = apacheSig.getSignedInfo().getLength();
    if (numReferences != 1) {
        log.error("Signature SignedInfo had invalid number of References: " + numReferences);
        throw new ValidationException("Signature SignedInfo must have exactly 1 Reference element");
    }

    Reference ref = null;
    try {
        ref = apacheSig.getSignedInfo().item(0);
    } catch (XMLSecurityException e) {
        log.error("Apache XML Security exception obtaining Reference", e);
        throw new ValidationException("Could not obtain Reference from Signature/SignedInfo", e);
    }
    if (ref == null) {
        log.error("Signature Reference was null");
        throw new ValidationException("Signature Reference was null");
    }
    return ref;
}
 

import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
private void checkReferences(XMLSignature xmlSignature) throws Exception {
    SignedInfo signedInfo = xmlSignature.getSignedInfo();
    assertTrue(signedInfo.getLength() > 0);
    for (int i = 0; i < signedInfo.getLength(); i++) {
        Reference reference = signedInfo.item(i);
        assertNotNull(reference);
        ReferenceData referenceData = reference.getReferenceData();
        assertNotNull(referenceData);

        if (referenceData instanceof ReferenceNodeSetData) {
            Iterator<Node> iter = ((ReferenceNodeSetData)referenceData).iterator();
            assertTrue(iter.hasNext());
            boolean found = false;
            while (iter.hasNext()) {
                Node n = iter.next();
                if (n instanceof Element) {
                    found = true;
                    break;
                }
            }
            assertTrue(found);
        } else if (referenceData instanceof ReferenceOctetStreamData) {
            assertNotNull(((ReferenceOctetStreamData)referenceData).getOctetStream());
        }
    }
}
 

import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
@Override
public void addReference(Reference r) throws CannotAddDataToDigestInputException
{
    if (null == r)
    {
        throw new NullPointerException();
    }

    try
    {
        XMLSignatureInput refData = r.getContentsAfterTransformation();
        addToDigestInput(refData, r.getDocument());

    } catch (XMLSignatureException ex)
    {
        throw new CannotAddDataToDigestInputException(ex);
    }
}
 

import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
@Override
protected BaseXAdESTimeStampData createPropDataObj(
        IndividualDataObjsTimeStampProperty prop,
        Algorithm c14n,
        TimeStampTokenRes tsTknRes,
        PropertiesDataGenerationContext ctx)
{
    Collection<DataObjectDesc> targetDataObjs = prop.getTargetDataObjects();
    Map<DataObjectDesc, Reference> refsMaps = ctx.getReferencesMappings();

    List<String> includes = new ArrayList<String>(targetDataObjs.size());
    for (DataObjectDesc dataObj : targetDataObjs)
    {
        Reference r = refsMaps.get(dataObj);
        includes.add('#' + r.getId());
    }

    prop.setTime(tsTknRes.timeStampTime);
    return new IndividualDataObjsTimeStampData(c14n, includes, tsTknRes.encodedTimeStampToken);
}
 

import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
/**
 * A simple constructor to be used when only unsigned signature properties
 * will be processed.
 * @param targetXmlSignature the target signature
 * @param algorithmsProvider algorithms in use
 */
PropertiesDataGenerationContext(XMLSignature targetXmlSignature) throws XAdES4jXMLSigException
{
    this.targetXmlSignature = targetXmlSignature;
    this.sigDocument = targetXmlSignature.getDocument();
    this.referencesMappings = null;

    SignedInfo signedInfo = targetXmlSignature.getSignedInfo();
    List<Reference> refs = new ArrayList<Reference>(signedInfo.getLength());
    for (int i = 0; i < signedInfo.getLength(); i++)
    {
        try
        {
            refs.add(signedInfo.item(i));
        } catch (XMLSecurityException ex)
        {
            throw new XAdES4jXMLSigException(String.format("Cannot process the %dth reference", i), ex);
        }
    }
    this.references = Collections.unmodifiableList(refs);
}
 

import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
@Test
public void testAddNullReference() throws Exception
{
    System.out.println("addNullReference");

    Document doc = SignatureServicesTestBase.getNewDocument();

    SignedDataObjects dataObjsDescs = new SignedDataObjects()
        .withSignedDataObject(new AnonymousDataObjectReference("data".getBytes()));

    XMLSignature xmlSignature = new XMLSignature(doc, "", XMLSignature.ALGO_ID_SIGNATURE_RSA_SHA256);
    xmlSignature.setId("sigId");

    SignedDataObjectsProcessor processor = new SignedDataObjectsProcessor(new TestAlgorithmsProvider(), new AllwaysNullAlgsParamsMarshaller());
    Map<DataObjectDesc, Reference> result = processor.process(dataObjsDescs, xmlSignature);

    assertEquals(1, result.size());
    assertEquals(0, xmlSignature.getObjectLength());
    assertEquals(1, xmlSignature.getSignedInfo().getLength());

    Reference r = xmlSignature.getSignedInfo().item(0);
    assertNull(r.getElement().getAttributeNodeNS(Constants.SignatureSpecNS, "URI"));
}
 

import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
/**
 * Method that generates a XAdES ContentTimestamp (either an ALL DATA OBJECTS TIMESTAMP or an INDIVIDUAL DATA
 * OBJECTS TIMESTAMP) and returns
 * it as a TimestampToken
 *
 * @param toSignDocument
 * @param externalParameters
 * @param timestampType
 * @return
 */
public TimestampToken generateXAdESContentTimestampAsTimestampToken(final DSSDocument toSignDocument, final XAdESSignatureParameters externalParameters,
		final TimestampType timestampType) {

	if (externalParameters == null) {
		throw new NullPointerException();
	}
	// 1. Set initial parameters
	final XAdESSignatureParameters signatureParameters = setSignatureParameters(externalParameters);

	// 2. Build temporary signature structure
	final XAdESLevelBaselineB levelBaselineB = new XAdESLevelBaselineB(commonCertificateVerifier);

	byte[] signatureValueBytes = Utils.fromBase64(fakeSignatureValue);
	final DSSDocument fullSignature = levelBaselineB.signDocument(toSignDocument, signatureParameters, signatureValueBytes);

	final List<Reference> references = getReferencesFromValidatedSignature(toSignDocument, fullSignature);

	// 4. Concatenate byte value of references, excluding references of type SignedProperties
	byte[] concatenatedReferences = concatenateReferencesAsByteArray(references);

	// 5. Generate ContentTimestamp using the concatenated references
	switch (timestampType) {
	case ALL_DATA_OBJECTS_TIMESTAMP:
	case INDIVIDUAL_DATA_OBJECTS_TIMESTAMP:
		return generateTimestampToken(timestampType, externalParameters, concatenatedReferences);
	default:
		throw new DSSException("Incompatible timestamp type");
	}
}
 

import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
/**
 * Validate an instance of {@link SignatureImpl}, which is in turn based on underlying Apache XML Security
 * <code>XMLSignature</code> instance.
 * 
 * @param sigImpl the signature implementation object to validate
 * @throws ValidationException thrown if the signature is not valid with respect to the profile
 */
protected void validateSignatureImpl(SignatureImpl sigImpl) throws ValidationException {

    if (sigImpl.getXMLSignature() == null) {
        log.error("SignatureImpl did not contain the an Apache XMLSignature child");
        throw new ValidationException("Apache XMLSignature does not exist on SignatureImpl");
    }
    XMLSignature apacheSig = sigImpl.getXMLSignature();

    if (!(sigImpl.getParent() instanceof SignableSAMLObject)) {
        log.error("Signature is not an immedidate child of a SignableSAMLObject");
        throw new ValidationException("Signature is not an immediate child of a SignableSAMLObject.");
    }
    SignableSAMLObject signableObject = (SignableSAMLObject) sigImpl.getParent();

    Reference ref = validateReference(apacheSig);

    String uri = ref.getURI();
    String id = signableObject.getSignatureReferenceID();

    validateReferenceURI(uri, id);

    validateTransforms(ref);
}
 

import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
private Set<ManifestEntry> getSignatureEntries(BDocSignature signature) {
  Set<ManifestEntry> signatureEntries = new HashSet<>();
  List<Reference> references = signature.getOrigin().getReferences();
  for (Reference reference : references) {
    if (reference.getType().equals("")) {
      String mimeTypeString = null;

      Node signatureNode = signature.getOrigin().getDssSignature().getSignatureElement();
      Node node = DomUtils.getNode(signatureNode, "./ds:SignedInfo/ds:Reference[@URI=\"" + reference.getURI() + "\"]");
      if (node != null) {
        String referenceId = node.getAttributes().getNamedItem("Id").getNodeValue();
        mimeTypeString = DomUtils.getValue(signatureNode,
            "./ds:Object/xades:QualifyingProperties/xades:SignedProperties/" +
                "xades:SignedDataObjectProperties/xades:DataObjectFormat" +
                "[@ObjectReference=\"#" + referenceId + "\"]/xades:MimeType");
      }

      // TODO: mimeTypeString == null ? node == null?
      String uri = getFileURI(reference);
      signatureEntries.add(new ManifestEntry(uri, mimeTypeString));
    }
  }

  return signatureEntries;
}
 

import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
/**
 *  Returns the digest algorithm identifier from the signature
 * 
 * @return      The algorithm identifier
 * @throws SAMLException    Thrown if the signature is missing
 */
public String getDigestAlgorithm()
    throws SAMLException
{
    if (isSigned()) {
        SignedInfo si=sig.getSignedInfo();
        if (si.getLength()==1) {
            Reference ref;
try {
	ref = si.item(0);
             return ref.getMessageDigestAlgorithm().getAlgorithmURI();
}
catch (XMLSecurityException e) {
	throw new InvalidCryptoException("SAMLSignedObject.getDigestAlgorithm() detected an XML security exception: " + e.getMessage(),e);
}
        }
    }
    throw new InvalidCryptoException("SAMLSignedObject.getDigestAlgorithm() can't examine unsigned or improperly signed object");           
}
 

import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
@org.junit.Test
public void testSigningVerifyingReference() throws Throwable {
    Document doc = getOriginalDocument();
    XMLSignature signature = signDocument(doc);

    PublicKey pubKey = getPublicKey();
    assertTrue(signature.checkSignatureValue(pubKey));

    // Check the reference(s)
    SignedInfo signedInfo = signature.getSignedInfo();
    assertTrue(signedInfo.getLength() == 1);
    Reference reference = signedInfo.item(0);
    ReferenceData referenceData = reference.getReferenceData();
    assertNotNull(referenceData);
    assertTrue(referenceData instanceof ReferenceNodeSetData);

    // Test the cached Element
    Element referenceElement =
        (Element)((ReferenceNodeSetData)referenceData).iterator().next();
    assertNotNull(referenceElement);
    assertTrue("root".equals(referenceElement.getLocalName()));

    Element originalElement =
        (Element) doc.getElementsByTagNameNS("http://ns.example.org/", "root").item(0);
    assertNotNull(originalElement);
    assertEquals(referenceElement, originalElement);
}
 

import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
@Override
protected void addPropSpecificTimeStampInput(
        IndividualDataObjsTimeStampProperty prop,
        TimeStampDigestInput digestInput,
        PropertiesDataGenerationContext ctx) throws CannotAddDataToDigestInputException
{
    Collection<DataObjectDesc> targetDataObjs = prop.getTargetDataObjects();
    Map<DataObjectDesc, Reference> refsMaps = ctx.getReferencesMappings();

    for (DataObjectDesc dataObj : targetDataObjs)
    {
        Reference r = refsMaps.get(dataObj);
        digestInput.addReference(r);
    }
}
 

import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
@Override
protected void addPropSpecificTimeStampInput(
        AllDataObjsTimeStampProperty prop,
        TimeStampDigestInput digestInput,
        PropertiesDataGenerationContext ctx) throws CannotAddDataToDigestInputException
{
    List<Reference> refs = ctx.getReferences();
    for (Reference r : refs)
    {
        digestInput.addReference(r);
    }
}
 

import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
@Override
public PropertyDataObject generatePropertyData(
        CommitmentTypeProperty prop,
        PropertiesDataGenerationContext ctx)
{
    CommitmentTypeData commTypeData = new CommitmentTypeData(
            prop.getUri(),
            prop.getDescription());

    /* One ObjectReference element refers to one ds:Reference element of the
     * ds:SignedInfo corresponding with one data object qualified by this
     * property. If some but not all the signed data objects share the same
     * commitment, one ObjectReference element MUST appear for each one of
     * them. However, if all the signed data objects share the same commitment,
     * the AllSignedDataObjects empty element MUST be present.
     */

    Collection<DataObjectDesc> targets = prop.getTargetDataObjects();
    Map<DataObjectDesc, Reference> referencesMappings = ctx.getReferencesMappings();

    for (DataObjectDesc obj : targets)
    {
        // The ObjectReference refers the Reference element. This assumes
        // that the QualifyingProperties are in the signature's document.
        commTypeData.addObjReferences('#' + referencesMappings.get(obj).getId());
    }

    commTypeData.setQualifiers(prop.getQualifiers());
    
    return commTypeData;
}
 

import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
@Override
public QualifyingProperty verify(
        GenericDOMData propData,
        QualifyingPropertyVerificationContext ctx) throws InvalidPropertyException
{


    XAdESVerificationResult res;
    try
    {
        Element sigElem = DOMHelper.getFirstChildElement(propData.getPropertyElement());
        res = verifier.verify(sigElem, null);
    } catch (XAdES4jException ex)
    {
        throw new CounterSignatureXadesVerificationException(ex);
    }

    // "Check that the enclosed signature correctly references the ds:SignatureValue
    // present in the countersigned XAdES signature."

    Node targetSigValueElem = ctx.getSignature().getElement().getElementsByTagNameNS(
            Constants.SignatureSpecNS, Constants._TAG_SIGNATUREVALUE).item(0);

    try
    {
        SignedInfo si = res.getXmlSignature().getSignedInfo();
        for (int i = 0; i < si.getLength(); i++)
        {
            Reference r = si.item(i);
            if (r.getContentsAfterTransformation().getSubNode() == targetSigValueElem)
                // The signature references the SignatureValue element.
                return new CounterSignatureProperty(res);
        }
        throw new CounterSignatureSigValueRefException();
    } catch (XMLSecurityException e)
    {
        // Shouldn't happen because the signature was already verified.
        throw new CounterSignatureVerificationException(e);
    }
}
 

import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
ReferencesRes(
        List<RawDataObjectDesc> dataObjsReferences,
        Reference signedPropsReference)
{
    this.dataObjsReferences = Collections.unmodifiableList(dataObjsReferences);
    this.signedPropsReference = signedPropsReference;
}
 

import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
static void checkSignedPropertiesIncorporation(Element qualifyingPropsElem, Reference signedPropsRef) throws QualifyingPropertiesIncorporationException
{
    Element signedPropsElem = DOMHelper.getFirstChildElement(qualifyingPropsElem);
    if (signedPropsElem == null
            || !signedPropsElem.getLocalName().equals(QualifyingProperty.SIGNED_PROPS_TAG)
            || !signedPropsElem.getNamespaceURI().equals(QualifyingProperty.XADES_XMLNS))
    {
        throw new QualifyingPropertiesIncorporationException("SignedProperties not found as the first child of QualifyingProperties.");
    }

    DOMHelper.useIdAsXmlId(signedPropsElem);

    // Only QualifyingProperties in the signature's document are supported.
    // XML-DSIG 4.3.3.2: "a same-document reference is defined as a URI-Reference
    // that consists of a hash sign ('#') followed by a fragment"
    if (!signedPropsRef.getURI().startsWith("#"))
    {
        throw new QualifyingPropertiesIncorporationException("Only QualifyingProperties in the signature's document are supported");
    }

    try
    {
        Node sPropsNode = signedPropsRef.getNodesetBeforeFirstCanonicalization().getSubNode();
        if (sPropsNode == null || sPropsNode.getNodeType() != Node.ELEMENT_NODE)
        {
            throw new QualifyingPropertiesIncorporationException("The supposed reference over signed properties doesn't cover an element.");
        }

        // The referenced signed properties element must be the child of qualifying properties.
        Element referencedSignedPropsElem = (Element) sPropsNode;
        if (referencedSignedPropsElem != signedPropsElem)
        {
            throw new QualifyingPropertiesIncorporationException("The referenced SignedProperties are not contained by the proper QualifyingProperties element");
        }
    } catch (XMLSignatureException ex)
    {
        throw new QualifyingPropertiesIncorporationException("Cannot get the referenced SignedProperties", ex);
    }
}
 

import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
public DataObjectFormatMismatchException(
        String mimeType, String encoding,
        Reference ref, ObjectContainer obj)
{
    this.mimeType = mimeType;
    this.encoding = encoding;
    this.reference = ref;
    this.object = obj;
}
 

import org.apache.xml.security.signature.Reference; //导入依赖的package包/类
@Test
public void testProcess() throws Exception
{
    System.out.println("process");

    Document doc = getNewDocument();

    SignedDataObjects dataObjsDescs = new SignedDataObjects()
        .withSignedDataObject(new DataObjectReference("uri").withTransform(new EnvelopedSignatureTransform()))
        .withSignedDataObject(new EnvelopedXmlObject(doc.createElement("test1")))
        .withSignedDataObject(new EnvelopedXmlObject(doc.createElement("test2"), "text/xml", null));

    XMLSignature xmlSignature = new XMLSignature(doc, "", XMLSignature.ALGO_ID_SIGNATURE_RSA_SHA256);
    xmlSignature.setId("sigId");

    AllwaysNullAlgsParamsMarshaller algsParamsMarshaller = new AllwaysNullAlgsParamsMarshaller();

    SignedDataObjectsProcessor processor = new SignedDataObjectsProcessor(new TestAlgorithmsProvider(), algsParamsMarshaller);
    Map<DataObjectDesc, Reference> result = processor.process(dataObjsDescs, xmlSignature);

    assertEquals(dataObjsDescs.getDataObjectsDescs().size(), result.size());
    assertEquals(2, xmlSignature.getObjectLength());
    assertEquals(xmlSignature.getSignedInfo().getLength(), dataObjsDescs.getDataObjectsDescs().size());

    assertEquals(1, algsParamsMarshaller.getInvokeCount());
    Reference ref = xmlSignature.getSignedInfo().item(0);
    assertEquals(1, ref.getTransforms().getLength());

    ObjectContainer obj = xmlSignature.getObjectItem(1);
    assertEquals("text/xml", obj.getMimeType());
    assertTrue(StringUtils.isNullOrEmptyString(obj.getEncoding()));

}