@@ -0,0 +1,2806 @@
+package javax.xml.crypto.test.dsig;%0A%0Aimport java.io.*;%0Aimport java.security.Security;%0Aimport javax.xml.crypto.dsig.*;%0Aimport javax.xml.crypto.dsig.dom.*;%0Aimport javax.xml.parsers.DocumentBuilderFactory;%0Aimport org.w3c.dom.*;%0A%0Aimport junit.framework.*;%0Aimport javax.xml.crypto.test.KeySelectors;%0A%0Apublic class SecureXSLTTest extends TestCase %7B%0A%0A    static %7B%0A        Security.insertProviderAt%0A            (new org.jcp.xml.dsig.internal.dom.XMLDSigRI(), 1);%0A    %7D%0A%0A    public SecureXSLTTest(String name) %7B%0A%09super(name);%0A    %7D%0A%0A    public void test() throws Exception %7B%0A%0A        String fs = System.getProperty(%22file.separator%22);%0A        File baseDir = new File(System.getProperty(%22basedir%22) + fs + %22data%22 %0A%09    + fs + %22javax%22 + fs + %22xml%22 + fs + %22crypto%22, %22dsig%22);%0A%0A        String%5B%5D signatures =%0A            %7B %22signature1.xml%22, %22signature2.xml%22, %22signature3.xml%22 %7D;%0A%0A        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();%0A        dbf.setNamespaceAware(true);%0A        XMLSignatureFactory fac = XMLSignatureFactory.getInstance(%22DOM%22);%0A        File f = new File(%22doc.xml%22);%0A        for (int i=0; i%3Csignatures.length; i++) %7B%0A%09    String signature = signatures%5Bi%5D;%0A            System.out.println(%22Validating %22 + signature);%0A            Document doc = dbf.newDocumentBuilder().parse%0A                (new FileInputStream(new File(baseDir, signature)));%0A%0A            NodeList nl =%0A                doc.getElementsByTagNameNS(XMLSignature.XMLNS, %22Signature%22);%0A            if (nl.getLength() == 0) %7B%0A                throw new Exception(%22Cannot find Signature element%22);%0A            %7D%0A%0A            DOMValidateContext valContext = new DOMValidateContext%0A                (new KeySelectors.KeyValueKeySelector(), nl.item(0));%0A%09    // enable reference caching in your validation context %0A%09    valContext.setProperty%0A    %09%09(%22javax.xml.crypto.dsig.cacheReference%22, Boolean.TRUE);%0A%0A            // make sure file is not left over from previous run%0A            f.delete();%0A%0A            XMLSignature sig = fac.unmarshalXMLSignature(valContext);%0A            try %7B%0A                if (sig.validate(valContext)) %7B%0A                    System.err.println(%22Signature UNEXPECTEDLY passed validation%22);%0A                %7D%0A%09%09Reference ref = (Reference) sig.getSignedInfo().getReferences().get(0);%0A            %7D catch (XMLSignatureException xse) %7B%0A                // this is good, but still make sure attack was not successful%0A                // by falling through and checking if file was created%0A//%09%09xse.printStackTrace();%0A            %7D%0A            if (f.exists()) %7B%0A                f.delete(); // cleanup file. comment out when debugging%0A                throw new Exception%0A                    (%22Test FAILED: doc.xml was successfully created%22);%0A            %7D%0A        %7D%0A        System.out.println(%22Test PASSED%22);%0A    %7D%0A%7D%0A

Test for bug 43145.