Details
-
Bug
-
Status: Open
-
Major
-
Resolution: Unresolved
-
Java 2.2.0
-
None
Description
When the old transformation algorithm
<ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116"> <ds:XPath>not(ancestor-or-self::ds:Signature)</ds:XPath> </ds:Transform>
is used in a XAdES signature the validation of the signature takes "forever" (3.59MB XML file, about 3 hours).
Using the more modern XPath2Filter
<ds:Transform Algorithm="http://www.w3.org/2002/06/xmldsig-filter2"> <dsig-xpath:XPath Filter="subtract" xmlns:dsig-xpath="http://www.w3.org/2002/06/xmldsig-filter2">/descendant::ds:Signature</dsig-xpath:XPath> </ds:Transform>
there's no such issue.
The call which causes this issue is org.apache.xml.security.signature.XMLSignature#checkSignatureValue(java.security.cert.X509Certificate)
Unfortunately I don't have any control on the signatures I receive.
Do you plan to optimize it? Is there a workaround?
I'm sorry but I can't attach the file I used, but you can find similar samples here where the same issue is raised.