naruto-lgtm opened a new pull request, #1472: URL: https://github.com/apache/poi/pull/1472
Repro: in a signed .docx (the new test uses `hello-world-signed.docx`), change the `Override` for `/word/document.xml` in `[Content_Types].xml` to `application/vnd.ms-word.document.macroEnabled.main+xml`. `OPCPackage` now reports the macro-enabled type for the part, but `SignatureInfo.verifySignature()` still returns true. Cause: `[Content_Types].xml` is not signed, so each manifest reference carries the part's content type as `/part?ContentType=...`, and that query is the only thing binding the type to the signature. `OOXMLURIDereferencer.dereference` resolves the part from `uri.getPath()` and drops the query, so the signed content type is never compared. Fix: compare the `ContentType` query with the part's content type (case-insensitive) and throw `URIReferenceException` on a mismatch. `verifySignature()` then fails the same way it already does for a reference to a missing part. Returning false instead would need special handling in `SignaturePart.validate`, so I kept the change in the dereferencer. References without the query and same-document references behave as before, and the existing dsig tests, including the sign-then-verify round trips, pass. `TestSignatureInfo.contentTypeChangeInvalidatesSignature` fails before the change. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
