naruto-lgtm opened a new pull request, #1467: URL: https://github.com/apache/poi/pull/1467
Repro: take a signed .docx (the new test uses `hello-world-signed.docx`), append `<Relationship Id="rId1" Type=".../officeDocument" Target="word/tampered.xml"/>` to `_rels/.rels`, and add that part with a content-type override. `XWPFDocument` now loads `word/tampered.xml`, but `SignatureInfo.verifySignature()` still returns true. Wrapping the duplicate in a foreign element (`<x:wrap xmlns:x="urn:x">...</x:wrap>`) has the same effect. Cause: `PackageRelationshipCollection` reads `Relationship` elements at any depth, and when an Id repeats, the last one wins. `RelationshipTransformService.transform` only looks at direct children and keeps the first element for each signed Id. So the injected element never reaches the digest, and the package resolves a signed Id to an unsigned part (signature wrapping, CWE-347). `[Content_Types].xml` is outside the signature by design, so nothing else catches the extra part. Fix: the transform now keeps every element that carries a signed Id, nested or repeated, sorted by Id. A substituted target therefore changes the digest, and validation returns false instead of throwing. Packages with unique Ids produce the same transform output as before. I put the check in the transform rather than rejecting duplicate Ids in the package loader, so lenient parsing of unsigned files is unchanged and only signature verification gets stricter. All `dsig` tests pass, including the Office 2007/2010, signed-twice and XAdES-X-L samples. The new parameterized test in `TestSignatureInfo` fails on both variants before the change. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
