Package eu.europa.esig.dss.validation

Class SignedDocumentValidator

java.lang.Object
eu.europa.esig.dss.validation.SignedDocumentValidator
All Implemented Interfaces:
DocumentValidator, ProcessExecutorProvider<DocumentProcessExecutor>
Direct Known Subclasses:
AbstractASiCContainerValidator, AbstractJWSDocumentValidator, CMSDocumentValidator, DetachedTimestampValidator, PDFDocumentValidator, XMLDocumentValidator
public abstract class SignedDocumentValidator
extends Object
implements DocumentValidator
Validates a signed document. The content of the document is determined automatically. It can be: XML, CAdES(p7m), PDF or ASiC(zip). SignatureScopeFinder can be set using the appropriate setter (ex. setCadesSignatureScopeFinder). By default, this class will use the default SignatureScopeFinder as defined by eu.europa.esig.dss.validation.scope.SignatureScopeFinderFactory

  • Field Details

    • processExecutor

      protected DocumentProcessExecutor processExecutor
      This variable can hold a specific DocumentProcessExecutor

    • document

      protected DSSDocument document
      The document to be validated (with the signature(s) or timestamp(s))

    • detachedContents

      protected List<DSSDocument> detachedContents
      In case of a detached signature this List contains the signed documents.

    • containerContents

      protected List<DSSDocument> containerContents
      In case of an ASiC signature this List of container documents.

    • manifestFile

      protected ManifestFile manifestFile
      A related ManifestFile to the provided document

    • signingCertificateSource

      protected CertificateSource signingCertificateSource
      Certificate source to find signing certificate

    • certificateVerifier

      protected CertificateVerifier certificateVerifier
      The reference to the certificate verifier. The current DSS implementation proposes CommonCertificateVerifier. This verifier encapsulates the references to different sources used in the signature validation process.

    • signatureScopeFinder

      protected final SignatureScopeFinder signatureScopeFinder
      The class to extract a list of SignatureScopes from a signature

    • skipValidationContextExecution

      protected boolean skipValidationContextExecution
      Defines if the validation context processing shall be skipped (Disable certificate chain building, revocation data collection,...) Default: false

  • Constructor Details

    • SignedDocumentValidator

      protected SignedDocumentValidator()
      The constructor with a null signatureScopeFinder

    • SignedDocumentValidator

      protected SignedDocumentValidator​(SignatureScopeFinder signatureScopeFinder)
      The default constructor
      Parameters:
      signatureScopeFinder - SignatureScopeFinder

  • Method Details

    • setSignedScopeFinderDefaultDigestAlgorithm

      protected void setSignedScopeFinderDefaultDigestAlgorithm​(DigestAlgorithm digestAlgorithm)
      Sets the default algorithm to use for a SignatureScopeFinder
      Parameters:
      digestAlgorithm - DigestAlgorithm

    • fromDocument

      public static SignedDocumentValidator fromDocument​(DSSDocument dssDocument)
      This method guesses the document format and returns an appropriate document validator.
      Parameters:
      dssDocument - The instance of DSSDocument to validate
      Returns:
      returns the specific instance of SignedDocumentValidator in terms of the document type

    • isSupported

      public abstract boolean isSupported​(DSSDocument dssDocument)
      Checks if the document is supported by the current validator
      Parameters:
      dssDocument - DSSDocument to check
      Returns:
      TRUE if the document is supported, FALSE otherwise

    • defineSigningCertificate

      @Deprecated public void defineSigningCertificate​(CertificateToken token)
      Deprecated.
      Description copied from interface: DocumentValidator
      This method allows to define the signing certificate. It is useful in the case of non AdES signatures.
      Specified by:
      defineSigningCertificate in interface DocumentValidator
      Parameters:
      token - CertificateToken

    • setSigningCertificateSource

      public void setSigningCertificateSource​(CertificateSource signingCertificateSource)
      Description copied from interface: DocumentValidator
      Set a certificate source which allows to find the signing certificate by kid or certificate's digest
      Specified by:
      setSigningCertificateSource in interface DocumentValidator
      Parameters:
      signingCertificateSource - the certificate source

    • setCertificateVerifier

      public void setCertificateVerifier​(CertificateVerifier certificateVerifier)
      To carry out the validation process of the signature(s) some external sources of certificates and of revocation data can be needed. The certificate verifier is used to pass these values. Note that once this setter is called any change in the content of the CommonTrustedCertificateSource or in adjunct certificate source is not taken into account.
      Specified by:
      setCertificateVerifier in interface DocumentValidator
      Parameters:
      certificateVerifier - CertificateVerifier

    • setTokenExtractionStrategy

      public void setTokenExtractionStrategy​(TokenExtractionStrategy tokenExtractionStrategy)
      Description copied from interface: DocumentValidator
      This method allows to set the token extraction strategy to follow in the diagnostic data generation.
      Specified by:
      setTokenExtractionStrategy in interface DocumentValidator
      Parameters:
      tokenExtractionStrategy - the TokenExtractionStrategy

    • setIncludeSemantics

      public void setIncludeSemantics​(boolean include)
      Description copied from interface: DocumentValidator
      This method allows to enable/disable the semantics inclusion in the reports (Indication / SubIndication meanings) Disabled by default
      Specified by:
      setIncludeSemantics in interface DocumentValidator
      Parameters:
      include - true to enable the inclusion of the semantics

    • setDetachedContents

      public void setDetachedContents​(List<DSSDocument> detachedContents)
      Description copied from interface: DocumentValidator
      Sets the List of DSSDocument containing the original contents to sign, for detached signature scenarios.
      Specified by:
      setDetachedContents in interface DocumentValidator
      Parameters:
      detachedContents - the List of DSSDocument to set

    • setContainerContents

      public void setContainerContents​(List<DSSDocument> containerContents)
      Description copied from interface: DocumentValidator
      Sets the List of DSSDocument containing the original container content for ASiC-S signatures.
      Specified by:
      setContainerContents in interface DocumentValidator
      Parameters:
      containerContents - the List of DSSDocument to set

    • setManifestFile

      public void setManifestFile​(ManifestFile manifestFile)
      Description copied from interface: DocumentValidator
      Sets a related ManifestFile to the document to be validated.
      Specified by:
      setManifestFile in interface DocumentValidator
      Parameters:
      manifestFile - a ManifestFile to set

    • getDefaultDigestAlgorithm

      protected DigestAlgorithm getDefaultDigestAlgorithm()
      Returns a default digest algorithm defined for a digest calculation
      Returns:
      DigestAlgorithm

    • setValidationTime

      public void setValidationTime​(Date validationTime)
      Allows to define a custom validation time
      Specified by:
      setValidationTime in interface DocumentValidator
      Parameters:
      validationTime - Date

    • getValidationTime

      protected Date getValidationTime()
      Returns validation time In case if the validation time is not provided, initialize the current time value from the system
      Returns:
      Date validation time

    • setValidationLevel

      public void setValidationLevel​(ValidationLevel validationLevel)
      Description copied from interface: DocumentValidator
      This method allows to specify the validation level (Basic / Timestamp / Long Term / Archival). By default, the selected validation is ARCHIVAL
      Specified by:
      setValidationLevel in interface DocumentValidator
      Parameters:
      validationLevel - ValidationLevel

    • setEnableEtsiValidationReport

      public void setEnableEtsiValidationReport​(boolean enableEtsiValidationReport)
      Description copied from interface: DocumentValidator
      This method allows to specify if the ETSI Validation Report must be generated. By default the value if TRUE (the ETSI Validation report will be generated).
      Specified by:
      setEnableEtsiValidationReport in interface DocumentValidator
      Parameters:
      enableEtsiValidationReport - - TRUE if the report must be generated, FALSE otherwise

    • validateDocument

      public Reports validateDocument()
      Description copied from interface: DocumentValidator
      Validates the document and all its signatures. The default constraint file is used.
      Specified by:
      validateDocument in interface DocumentValidator
      Returns:
      Reports: diagnostic data, detailed report and simple report

    • validateDocument

      public Reports validateDocument​(URL validationPolicyURL)
      Description copied from interface: DocumentValidator
      Validates the document and all its signatures. If the validation policy URL is set then the policy constraints are retrieved from this location. If null or empty the default file is used.
      Specified by:
      validateDocument in interface DocumentValidator
      Parameters:
      validationPolicyURL - URL
      Returns:
      Reports: diagnostic data, detailed report and simple report

    • validateDocument

      public Reports validateDocument​(String policyResourcePath)
      Description copied from interface: DocumentValidator
      Validates the document and all its signatures. The policyResourcePath specifies the constraint file. If null or empty the default file is used.
      Specified by:
      validateDocument in interface DocumentValidator
      Parameters:
      policyResourcePath - is located against the classpath (getClass().getResourceAsStream), and NOT the filesystem
      Returns:
      Reports: diagnostic data, detailed report and simple report

    • validateDocument

      public Reports validateDocument​(File policyFile)
      Description copied from interface: DocumentValidator
      Validates the document and all its signatures. The File parameter specifies the constraint file. If null or empty the default file is used.
      Specified by:
      validateDocument in interface DocumentValidator
      Parameters:
      policyFile - contains the validation policy (xml) as File
      Returns:
      Reports: diagnostic data, detailed report and simple report

    • validateDocument

      public Reports validateDocument​(InputStream policyDataStream)
      Validates the document and all its signatures. The policyDataStream contains the constraint file. If null or empty the default file is used.
      Specified by:
      validateDocument in interface DocumentValidator
      Parameters:
      policyDataStream - the InputStream with the validation policy
      Returns:
      the validation reports

    • validateDocument

      public Reports validateDocument​(ConstraintsParameters validationPolicyJaxb)
      Validates the document and all its signatures. The validationPolicyDom contains the constraint file. If null or empty the default file is used.
      Specified by:
      validateDocument in interface DocumentValidator
      Parameters:
      validationPolicyJaxb - the ConstraintsParameters to use in the validation process
      Returns:
      the validation reports

    • validateDocument

      public Reports validateDocument​(ValidationPolicy validationPolicy)
      Validates the document and all its signatures. The validationPolicyDom contains the constraint file. If null or empty the default file is used.
      Specified by:
      validateDocument in interface DocumentValidator
      Parameters:
      validationPolicy - the ValidationPolicy to use in the validation process
      Returns:
      the validation reports

    • assertConfigurationValid

      protected void assertConfigurationValid()
      Checks if the Validator configuration is valid

    • prepareDiagnosticDataBuilder

      protected DiagnosticDataBuilder prepareDiagnosticDataBuilder​(ValidationContext validationContext)
      Creates a DiagnosticDataBuilder
      Parameters:
      validationContext - ValidationContext
      Returns:
      DiagnosticDataBuilder

    • initializeDiagnosticDataBuilder

      protected SignedDocumentDiagnosticDataBuilder initializeDiagnosticDataBuilder()
      Initializes a relevant DiagnosticDataBuilder for the given implementation
      Returns:
      SignedDocumentDiagnosticDataBuilder

    • createDiagnosticDataBuilder

      protected DiagnosticDataBuilder createDiagnosticDataBuilder​(ValidationContext validationContext, List<AdvancedSignature> signatures, ListRevocationSource<CRL> listCRLSource, ListRevocationSource<OCSP> listOCSPSource)
      Creates and fills the DiagnosticDataBuilder with a relevant data
      Parameters:
      validationContext - ValidationContext used for the validation
      signatures - a list of AdvancedSignatures to be validated
      listCRLSource - ListRevocationSource used for CRL collection
      listOCSPSource - ListRevocationSource used for OCSP collection
      Returns:
      filled DiagnosticDataBuilder

    • prepareCertificateVerifier

      protected void prepareCertificateVerifier​(ListRevocationSource<CRL> listCRLSource, ListRevocationSource<OCSP> listOCSPSource, ListCertificateSource listCertificateSource)
      Sets revocation sources for a following certificate validation
      Parameters:
      listCRLSource - ListRevocationSource
      listOCSPSource - ListRevocationSource
      listCertificateSource - ListCertificateSource

    • mergeCRLSources

      protected ListRevocationSource<CRL> mergeCRLSources​(Collection<AdvancedSignature> allSignatureList, Collection<TimestampToken> detachedTimestamps)
      For all signatures to be validated this method merges the CRL sources.
      Parameters:
      allSignatureList - Collection of AdvancedSignatures to validate including the counter-signatures
      detachedTimestamps - Collection of TimestampTokens detached to a validating file
      Returns:
      merged CRL Source

    • mergeOCSPSources

      protected ListRevocationSource<OCSP> mergeOCSPSources​(Collection<AdvancedSignature> allSignatureList, Collection<TimestampToken> detachedTimestamps)
      For all signatures to be validated this method merges the OCSP sources.
      Parameters:
      allSignatureList - Collection of AdvancedSignatures to validate including the counter-signatures
      detachedTimestamps - Collection of TimestampTokens detached to a validating file
      Returns:
      merged OCSP Source

    • mergeCertificateSource

      protected ListCertificateSource mergeCertificateSource​(Collection<AdvancedSignature> allSignatureList, Collection<TimestampToken> detachedTimestamps)
      For all signatures to be validated this method merges the Certificate sources.
      Parameters:
      allSignatureList - Collection of AdvancedSignatures to validate including the counter-signatures
      detachedTimestamps - Collection of TimestampTokens detached to a validating file
      Returns:
      merged Certificate Source

    • prepareSignatureValidationContext

      public void prepareSignatureValidationContext​(ValidationContext validationContext, List<AdvancedSignature> allSignatureList)
      Description copied from interface: DocumentValidator
      Prepares the validationContext for signature validation process and returns a list of signatures to validate
      Specified by:
      prepareSignatureValidationContext in interface DocumentValidator
      Parameters:
      validationContext - ValidationContext
      allSignatureList - a list of all AdvancedSignatures to be validated

    • prepareCertificatesAndTimestamps

      protected void prepareCertificatesAndTimestamps​(ValidationContext validationContext, List<AdvancedSignature> allSignatureList)
      Parameters:
      allSignatureList - List of AdvancedSignatures to validate including the countersignatures
      validationContext - ValidationContext is the implementation of the validators for: certificates, timestamps and revocation data.

    • prepareDetachedTimestampValidationContext

      public void prepareDetachedTimestampValidationContext​(ValidationContext validationContext, List<TimestampToken> timestamps)
      Prepares the validationContext for a timestamp validation process
      Specified by:
      prepareDetachedTimestampValidationContext in interface DocumentValidator
      Parameters:
      validationContext - ValidationContext
      timestamps - a list of timestamps

    • validateContext

      protected void validateContext​(ValidationContext validationContext)
      Process the validation
      Parameters:
      validationContext - ValidationContext to process

    • setSignaturePolicyProvider

      public void setSignaturePolicyProvider​(SignaturePolicyProvider signaturePolicyProvider)
      Description copied from interface: DocumentValidator
      This method allows to set a provider for Signature policies
      Specified by:
      setSignaturePolicyProvider in interface DocumentValidator
      Parameters:
      signaturePolicyProvider - SignaturePolicyProvider

    • getSignaturePolicyProvider

      protected SignaturePolicyProvider getSignaturePolicyProvider()
      Returns a signaturePolicyProvider If not defined, returns a default provider
      Returns:
      SignaturePolicyProvider

    • setProcessExecutor

      public void setProcessExecutor​(DocumentProcessExecutor processExecutor)
      Description copied from interface: ProcessExecutorProvider
      This method provides the possibility to set the specific CustomProcessExecutor
      Specified by:
      setProcessExecutor in interface ProcessExecutorProvider<DocumentProcessExecutor>
      Parameters:
      processExecutor - ProcessExecutor

    • provideProcessExecutorInstance

      protected DocumentProcessExecutor provideProcessExecutorInstance()
      This method returns the process executor. If the instance of this class is not yet instantiated then the new instance is created.
      Returns:
      SignatureProcessExecutor

    • getDefaultProcessExecutor

      public DocumentProcessExecutor getDefaultProcessExecutor()
      Description copied from interface: ProcessExecutorProvider
      Returns a default for a validator process executor
      Specified by:
      getDefaultProcessExecutor in interface ProcessExecutorProvider<DocumentProcessExecutor>
      Returns:
      Process Executor

    • processValidationPolicy

      protected final Reports processValidationPolicy​(XmlDiagnosticData diagnosticData, ValidationPolicy validationPolicy)
      Executes the validation regarding to the given validationPolicy
      Parameters:
      diagnosticData - DiagnosticData contained a data to be validated
      validationPolicy - ValidationPolicy
      Returns:
      validation Reports

    • getAllSignatures

      protected List<AdvancedSignature> getAllSignatures()
      Returns a list of all signatures from the valdiating document
      Returns:
      a list of AdvancedSignatures

    • appendCounterSignatures

      protected void appendCounterSignatures​(List<AdvancedSignature> allSignatureList, AdvancedSignature signature)
      The util method to link counter signatures with the related master signatures
      Parameters:
      allSignatureList - a list of AdvancedSignatures
      signature - current AdvancedSignature

    • getSignatures

      public List<AdvancedSignature> getSignatures()
      Description copied from interface: DocumentValidator
      Retrieves the signatures found in the document
      Specified by:
      getSignatures in interface DocumentValidator
      Returns:
      a list of AdvancedSignatures for validation purposes

    • getDetachedTimestamps

      public List<TimestampToken> getDetachedTimestamps()
      Description copied from interface: DocumentValidator
      Retrieves the detached timestamps found in the document
      Specified by:
      getDetachedTimestamps in interface DocumentValidator
      Returns:
      a list of TimestampToken for validation purposes

    • processSignaturesValidation

      public void processSignaturesValidation​(List<AdvancedSignature> allSignatureList)
      Description copied from interface: DocumentValidator
      This method process the signature validation on the given allSignatureList
      Specified by:
      processSignaturesValidation in interface DocumentValidator
      Parameters:
      allSignatureList - list of AdvancedSignatures to be validated

    • findSignatureScopes

      public void findSignatureScopes​(List<AdvancedSignature> allSignatures)
      Finds and assigns SignatureScopes for a list of signatures
      Specified by:
      findSignatureScopes in interface DocumentValidator
      Parameters:
      allSignatures - a list of AdvancedSignatures to get a SignatureScope list

    • setSkipValidationContextExecution

      public void setSkipValidationContextExecution​(boolean skipValidationContextExecution)
      Sets if the validation context execution shall be skipped (skips certificate chain building, revocation requests, ...)
      Parameters:
      skipValidationContextExecution - if the context validation shall be skipped

    • setLocale

      public void setLocale​(Locale locale)
      Sets Locale for report messages generation
      Parameters:
      locale - Locale