Package eu.europa.esig.dss.validation

Class SignedDocumentValidator

java.lang.Object

eu.europa.esig.dss.validation.SignedDocumentValidator

All Implemented Interfaces:

DocumentValidator, ProcessExecutorProvider<DocumentProcessExecutor>

Direct Known Subclasses:

AbstractASiCContainerValidator, CMSDocumentValidator, DetachedTimestampValidator, PDFDocumentValidator, XMLDocumentValidator

public abstract class SignedDocumentValidator
extends Object
implements DocumentValidator

Validates a signed document. The content of the document is determined automatically. It can be: XML, CAdES(p7m), PDF or ASiC(zip). SignatureScopeFinder can be set using the appropriate setter (ex. setCadesSignatureScopeFinder). By default, this class will use the default SignatureScopeFinder as defined by eu.europa.esig.dss.validation.scope.SignatureScopeFinderFactory

Field Summary

Fields

Modifier and Type	Field	Description
protected CertificateVerifier	certificateVerifier	The reference to the certificate verifier.
protected List<DSSDocument>	containerContents	In case of an ASiC signature this List of container documents.
protected List<DSSDocument>	detachedContents	In case of a detached signature this List contains the signed documents.
protected DSSDocument	document	The document to be validated (with the signature(s) or timestamp(s))
protected List<ManifestFile>	manifestFiles	List of all found ManifestFiles
protected DocumentProcessExecutor	processExecutor	This variable can hold a specific DocumentProcessExecutor
protected CertificateToken	providedSigningCertificateToken
protected SignatureScopeFinder	signatureScopeFinder
protected boolean	skipValidationContextExecution

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	SignedDocumentValidator()
protected	SignedDocumentValidator(SignatureScopeFinder signatureScopeFinder)

Method Summary

Modifier and Type	Method	Description
protected void	assertConfigurationValid()	Checks if the Validator configuration is valid
void	defineSigningCertificate(CertificateToken token)	This method allows to define the signing certificate.
void	findSignatureScopes(List<AdvancedSignature> allSignatures)	Finds and assigns SignatureScopes for a list of signatures
static SignedDocumentValidator	fromDocument(DSSDocument dssDocument)	This method guesses the document format and returns an appropriate document validator.
protected List<AdvancedSignature>	getAllSignatures()
protected DigestAlgorithm	getDefaultDigestAlgorithm()	Returns a default digest algorithm defined for a digest calculation
DocumentProcessExecutor	getDefaultProcessExecutor()	Returns a default for a validator process executor
List<TimestampToken>	getDetachedTimestamps()	Retrieves the detached timestamps found in the document
protected DiagnosticDataBuilder	getDiagnosticDataBuilderConfiguration(ValidationContext validationContext, List<AdvancedSignature> signatures, ListRevocationSource<CRL> listCRLSource, ListRevocationSource<OCSP> listOCSPSource)
protected SignaturePolicyProvider	getSignaturePolicyProvider()	Returns a signaturePolicyProvider If not defined, returns a default provider
List<AdvancedSignature>	getSignatures()	Retrieves the signatures found in the document
protected Date	getValidationTime()	Returns validation time In case if the validation time is not provided, initialize the current time value from the system
abstract boolean	isSupported(DSSDocument dssDocument)
protected ListCertificateSource	mergeCertificateSource(Collection<AdvancedSignature> allSignatureList, Collection<TimestampToken> detachedTimestamps)	For all signatures to be validated this method merges the Certificate sources.
protected ListRevocationSource<CRL>	mergeCRLSources(Collection<AdvancedSignature> allSignatureList, Collection<TimestampToken> detachedTimestamps)	For all signatures to be validated this method merges the CRL sources.
protected ListRevocationSource<OCSP>	mergeOCSPSources(Collection<AdvancedSignature> allSignatureList, Collection<TimestampToken> detachedTimestamps)	For all signatures to be validated this method merges the OCSP sources.
protected void	prepareCertificatesAndTimestamps(ValidationContext validationContext, List<AdvancedSignature> allSignatureList)
protected void	prepareCertificateVerifier(ListRevocationSource<CRL> listCRLSource, ListRevocationSource<OCSP> listOCSPSource, ListCertificateSource listCertificateSource)	Sets revocation sources for a following certificate validation
void	prepareDetachedTimestampValidationContext(ValidationContext validationContext, List<TimestampToken> timestamps)	Prepares the validationContext for a timestamp validation process
protected DiagnosticDataBuilder	prepareDiagnosticDataBuilder(ValidationContext validationContext)	Creates a DiagnosticData to pass to the validation process
void	prepareSignatureValidationContext(ValidationContext validationContext, List<AdvancedSignature> allSignatureList)	Prepares the validationContext for signature validation process and returns a list of signatures to validate
void	processSignaturesValidation(List<AdvancedSignature> allSignatureList)	This method process the signature validation on the given allSignatureList
protected Reports	processValidationPolicy(XmlDiagnosticData diagnosticData, ValidationPolicy validationPolicy)	Executes the validation regarding to the given validationPolicy
protected DocumentProcessExecutor	provideProcessExecutorInstance()	This method returns the process executor.
void	setCertificateVerifier(CertificateVerifier certificateVerifier)	To carry out the validation process of the signature(s) some external sources of certificates and of revocation data can be needed.
void	setContainerContents(List<DSSDocument> containerContents)	Sets the List of DSSDocument containing the original container content for ASiC signatures.
void	setDetachedContents(List<DSSDocument> detachedContents)	Sets the List of DSSDocument containing the original contents to sign, for detached signature scenarios.
void	setEnableEtsiValidationReport(boolean enableEtsiValidationReport)	This method allows to specify if the ETSI Validation Report must be generated.
void	setIncludeSemantics(boolean include)	This method allows to enable/disable the semantics inclusion in the reports (Indication / SubIndication meanings) Disabled by default
void	setLocale(Locale locale)
void	setManifestFiles(List<ManifestFile> manifestFiles)	Sets the List of ManifestFiles found in the signature file.
void	setProcessExecutor(DocumentProcessExecutor processExecutor)	This method provides the possibility to set the specific CustomProcessExecutor
void	setSignaturePolicyProvider(SignaturePolicyProvider signaturePolicyProvider)	This method allows to set a provider for Signature policies
protected void	setSignedScopeFinderDefaultDigestAlgorithm(DigestAlgorithm digestAlgorithm)
void	setSkipValidationContextExecution(boolean skipValidationContextExecution)
void	setTokenExtractionStategy(TokenExtractionStategy tokenExtractionStategy)	This method allows to set the token extraction strategy to follow in the diagnostic data generation.
void	setValidationLevel(ValidationLevel validationLevel)	This method allows to specify the validation level (Basic / Timestamp / Long Term / Archival).
void	setValidationTime(Date validationTime)	Allows to define a custom validation time
protected void	validateContext(ValidationContext validationContext)	Process the validation
Reports	validateDocument()	Validates the document and all its signatures.
Reports	validateDocument(ConstraintsParameters validationPolicyJaxb)	Validates the document and all its signatures.
Reports	validateDocument(ValidationPolicy validationPolicy)	Validates the document and all its signatures.
Reports	validateDocument(File policyFile)	Validates the document and all its signatures.
Reports	validateDocument(InputStream policyDataStream)	Validates the document and all its signatures.
Reports	validateDocument(String policyResourcePath)	Validates the document and all its signatures.
Reports	validateDocument(URL validationPolicyURL)	Validates the document and all its signatures.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface eu.europa.esig.dss.validation.DocumentValidator

getOriginalDocuments, getOriginalDocuments

Field Details

processExecutor

protected DocumentProcessExecutor processExecutor

This variable can hold a specific DocumentProcessExecutor

document

protected DSSDocument document

The document to be validated (with the signature(s) or timestamp(s))

detachedContents

protected List<DSSDocument> detachedContents

In case of a detached signature this List contains the signed documents.

containerContents

protected List<DSSDocument> containerContents

In case of an ASiC signature this List of container documents.

manifestFiles

protected List<ManifestFile> manifestFiles

List of all found ManifestFiles

providedSigningCertificateToken

protected CertificateToken providedSigningCertificateToken

certificateVerifier

protected CertificateVerifier certificateVerifier

The reference to the certificate verifier. The current DSS implementation proposes CommonCertificateVerifier. This verifier encapsulates the references to different sources used in the signature validation process.

signatureScopeFinder

protected final SignatureScopeFinder signatureScopeFinder

skipValidationContextExecution

protected boolean skipValidationContextExecution

Constructor Details

SignedDocumentValidator

protected SignedDocumentValidator()

SignedDocumentValidator

protected SignedDocumentValidator(SignatureScopeFinder signatureScopeFinder)

Method Details

setSignedScopeFinderDefaultDigestAlgorithm

protected void setSignedScopeFinderDefaultDigestAlgorithm(DigestAlgorithm digestAlgorithm)

fromDocument

public static SignedDocumentValidator fromDocument(DSSDocument dssDocument)

This method guesses the document format and returns an appropriate document validator.

Parameters:

dssDocument - The instance of DSSDocument to validate

Returns:

returns the specific instance of SignedDocumentValidator in terms of the document type

isSupported

public abstract boolean isSupported(DSSDocument dssDocument)

defineSigningCertificate

public void defineSigningCertificate(CertificateToken token)

Description copied from interface: DocumentValidator

This method allows to define the signing certificate. It is useful in the case of non AdES signatures.

Specified by:

defineSigningCertificate in interface DocumentValidator

setCertificateVerifier

public void setCertificateVerifier(CertificateVerifier certificateVerifier)

To carry out the validation process of the signature(s) some external sources of certificates and of revocation data can be needed. The certificate verifier is used to pass these values. Note that once this setter is called any change in the content of the CommonTrustedCertificateSource or in adjunct certificate source is not taken into account.

Specified by:

setCertificateVerifier in interface DocumentValidator

Parameters:

certificateVerifier -

setTokenExtractionStategy

public void setTokenExtractionStategy(TokenExtractionStategy tokenExtractionStategy)

Description copied from interface: DocumentValidator

This method allows to set the token extraction strategy to follow in the diagnostic data generation.

Specified by:

setTokenExtractionStategy in interface DocumentValidator

Parameters:

tokenExtractionStategy - the TokenExtractionStategy

setIncludeSemantics

public void setIncludeSemantics(boolean include)

Description copied from interface: DocumentValidator

This method allows to enable/disable the semantics inclusion in the reports (Indication / SubIndication meanings) Disabled by default

Specified by:

setIncludeSemantics in interface DocumentValidator

Parameters:

include - true to enable the inclusion of the semantics

setDetachedContents

public void setDetachedContents(List<DSSDocument> detachedContents)

Description copied from interface: DocumentValidator

Sets the List of DSSDocument containing the original contents to sign, for detached signature scenarios.

Specified by:

setDetachedContents in interface DocumentValidator

Parameters:

detachedContents - the List of DSSDocument to set

setContainerContents

public void setContainerContents(List<DSSDocument> containerContents)

Description copied from interface: DocumentValidator

Sets the List of DSSDocument containing the original container content for ASiC signatures.

Specified by:

setContainerContents in interface DocumentValidator

Parameters:

containerContents - the List of DSSDocument to set

setManifestFiles

public void setManifestFiles(List<ManifestFile> manifestFiles)

Description copied from interface: DocumentValidator

Sets the List of ManifestFiles found in the signature file.

Specified by:

setManifestFiles in interface DocumentValidator

Parameters:

manifestFiles - the List of ManifestFile to set

getDefaultDigestAlgorithm

protected DigestAlgorithm getDefaultDigestAlgorithm()

Returns a default digest algorithm defined for a digest calculation

Returns:

DigestAlgorithm

setValidationTime

public void setValidationTime(Date validationTime)

Allows to define a custom validation time

Specified by:

setValidationTime in interface DocumentValidator

Parameters:

validationTime - Date

getValidationTime

protected Date getValidationTime()

Returns validation time In case if the validation time is not provided, initialize the current time value from the system

Returns:

Date validation time

setValidationLevel

public void setValidationLevel(ValidationLevel validationLevel)

Description copied from interface: DocumentValidator

This method allows to specify the validation level (Basic / Timestamp / Long Term / Archival). By default, the selected validation is ARCHIVAL

Specified by:

setValidationLevel in interface DocumentValidator

Parameters:

validationLevel - ValidationLevel

setEnableEtsiValidationReport

public void setEnableEtsiValidationReport(boolean enableEtsiValidationReport)

Description copied from interface: DocumentValidator

This method allows to specify if the ETSI Validation Report must be generated. By default the value if TRUE (the ETSI Validation report will be generated).

Specified by:

setEnableEtsiValidationReport in interface DocumentValidator

Parameters:

enableEtsiValidationReport - - TRUE if the report must be generated, FALSE otherwise

validateDocument

public Reports validateDocument()

Description copied from interface: DocumentValidator

Validates the document and all its signatures. The default constraint file is used.

Specified by:

validateDocument in interface DocumentValidator

Returns:

Reports: diagnostic data, detailed report and simple report

validateDocument

public Reports validateDocument(URL validationPolicyURL)

Description copied from interface: DocumentValidator

Validates the document and all its signatures. If the validation policy URL is set then the policy constraints are retrieved from this location. If null or empty the default file is used.

Specified by:

validateDocument in interface DocumentValidator

Returns:

Reports: diagnostic data, detailed report and simple report

validateDocument

public Reports validateDocument(String policyResourcePath)

Description copied from interface: DocumentValidator

Validates the document and all its signatures. The policyResourcePath specifies the constraint file. If null or empty the default file is used.

Specified by:

validateDocument in interface DocumentValidator

Parameters:

policyResourcePath - is located against the classpath (getClass().getResourceAsStream), and NOT the filesystem

Returns:

Reports: diagnostic data, detailed report and simple report

validateDocument

public Reports validateDocument(File policyFile)

Description copied from interface: DocumentValidator

Validates the document and all its signatures. The File parameter specifies the constraint file. If null or empty the default file is used.

Specified by:

validateDocument in interface DocumentValidator

Parameters:

policyFile - contains the validation policy (xml) as File

Returns:

Reports: diagnostic data, detailed report and simple report

validateDocument

public Reports validateDocument(InputStream policyDataStream)

Validates the document and all its signatures. The policyDataStream contains the constraint file. If null or empty the default file is used.

Specified by:

validateDocument in interface DocumentValidator

Parameters:

policyDataStream - the InputStream with the validation policy

Returns:

the validation reports

validateDocument

public Reports validateDocument(ConstraintsParameters validationPolicyJaxb)

Validates the document and all its signatures. The validationPolicyDom contains the constraint file. If null or empty the default file is used.

Specified by:

validateDocument in interface DocumentValidator

Parameters:

validationPolicyJaxb - the ConstraintsParameters to use in the validation process

Returns:

the validation reports

validateDocument

public Reports validateDocument(ValidationPolicy validationPolicy)

Validates the document and all its signatures. The validationPolicyDom contains the constraint file. If null or empty the default file is used.

Specified by:

validateDocument in interface DocumentValidator

Parameters:

validationPolicy - the ValidationPolicy to use in the validation process

Returns:

the validation reports

assertConfigurationValid

protected void assertConfigurationValid()

Checks if the Validator configuration is valid

prepareDiagnosticDataBuilder

protected DiagnosticDataBuilder prepareDiagnosticDataBuilder(ValidationContext validationContext)

Creates a DiagnosticData to pass to the validation process

Parameters:

validationContext - ValidationContext

Returns:

DiagnosticData

getDiagnosticDataBuilderConfiguration

protected DiagnosticDataBuilder getDiagnosticDataBuilderConfiguration(ValidationContext validationContext, List<AdvancedSignature> signatures, ListRevocationSource<CRL> listCRLSource, ListRevocationSource<OCSP> listOCSPSource)

prepareCertificateVerifier

protected void prepareCertificateVerifier(ListRevocationSource<CRL> listCRLSource, ListRevocationSource<OCSP> listOCSPSource, ListCertificateSource listCertificateSource)

Sets revocation sources for a following certificate validation

Parameters:

listCRLSource - ListRevocationSource

listOCSPSource - ListRevocationSource

listCertificateSource - ListCertificateSource

mergeCRLSources

protected ListRevocationSource<CRL> mergeCRLSources(Collection<AdvancedSignature> allSignatureList, Collection<TimestampToken> detachedTimestamps)

For all signatures to be validated this method merges the CRL sources.

Parameters:

allSignatureList - Collection of AdvancedSignatures to validate including the counter-signatures

detachedTimestamps - Collection of TimestampTokens detached to a validating file

Returns:

merged CRL Source

mergeOCSPSources

protected ListRevocationSource<OCSP> mergeOCSPSources(Collection<AdvancedSignature> allSignatureList, Collection<TimestampToken> detachedTimestamps)

For all signatures to be validated this method merges the OCSP sources.

Parameters:

allSignatureList - Collection of AdvancedSignatures to validate including the counter-signatures

detachedTimestamps - Collection of TimestampTokens detached to a validating file

Returns:

merged OCSP Source

mergeCertificateSource

protected ListCertificateSource mergeCertificateSource(Collection<AdvancedSignature> allSignatureList, Collection<TimestampToken> detachedTimestamps)

For all signatures to be validated this method merges the Certificate sources.

Parameters:

allSignatureList - Collection of AdvancedSignatures to validate including the counter-signatures

detachedTimestamps - Collection of TimestampTokens detached to a validating file

Returns:

merged Certificate Source

prepareSignatureValidationContext

public void prepareSignatureValidationContext(ValidationContext validationContext, List<AdvancedSignature> allSignatureList)

Description copied from interface: DocumentValidator

Prepares the validationContext for signature validation process and returns a list of signatures to validate

Specified by:

prepareSignatureValidationContext in interface DocumentValidator

Parameters:

validationContext - ValidationContext

allSignatureList - a list of all AdvancedSignatures to be validated

prepareCertificatesAndTimestamps

protected void prepareCertificatesAndTimestamps(ValidationContext validationContext, List<AdvancedSignature> allSignatureList)

Parameters:

allSignatureList - List of AdvancedSignatures to validate including the countersignatures

validationContext - ValidationContext is the implementation of the validators for: certificates, timestamps and revocation data.

prepareDetachedTimestampValidationContext

public void prepareDetachedTimestampValidationContext(ValidationContext validationContext, List<TimestampToken> timestamps)

Prepares the validationContext for a timestamp validation process

Specified by:

prepareDetachedTimestampValidationContext in interface DocumentValidator

Parameters:

validationContext - ValidationContext

timestamps - a list of timestamps

validateContext

protected void validateContext(ValidationContext validationContext)

Process the validation

Parameters:

validationContext - ValidationContext to process

setSignaturePolicyProvider

public void setSignaturePolicyProvider(SignaturePolicyProvider signaturePolicyProvider)

Description copied from interface: DocumentValidator

This method allows to set a provider for Signature policies

Specified by:

setSignaturePolicyProvider in interface DocumentValidator

getSignaturePolicyProvider

protected SignaturePolicyProvider getSignaturePolicyProvider()

Returns a signaturePolicyProvider If not defined, returns a default provider

Returns:

SignaturePolicyProvider

setProcessExecutor

public void setProcessExecutor(DocumentProcessExecutor processExecutor)

Description copied from interface: ProcessExecutorProvider

This method provides the possibility to set the specific CustomProcessExecutor

Specified by:

setProcessExecutor in interface ProcessExecutorProvider<DocumentProcessExecutor>

provideProcessExecutorInstance

protected DocumentProcessExecutor provideProcessExecutorInstance()

This method returns the process executor. If the instance of this class is not yet instantiated then the new instance is created.

Returns:

SignatureProcessExecutor

getDefaultProcessExecutor

public DocumentProcessExecutor getDefaultProcessExecutor()

Description copied from interface: ProcessExecutorProvider

Returns a default for a validator process executor

Specified by:

getDefaultProcessExecutor in interface ProcessExecutorProvider<DocumentProcessExecutor>

Returns:

Process Executor

processValidationPolicy

protected final Reports processValidationPolicy(XmlDiagnosticData diagnosticData, ValidationPolicy validationPolicy)

Executes the validation regarding to the given validationPolicy

Parameters:

diagnosticData - DiagnosticData contained a data to be validated

validationPolicy - ValidationPolicy

Returns:

validation Reports

getAllSignatures

protected List<AdvancedSignature> getAllSignatures()

getSignatures

public List<AdvancedSignature> getSignatures()

Description copied from interface: DocumentValidator

Retrieves the signatures found in the document

Specified by:

getSignatures in interface DocumentValidator

Returns:

a list of AdvancedSignatures for validation purposes

getDetachedTimestamps

public List<TimestampToken> getDetachedTimestamps()

Description copied from interface: DocumentValidator

Retrieves the detached timestamps found in the document

Specified by:

getDetachedTimestamps in interface DocumentValidator

Returns:

a list of TimestampToken for validation purposes

processSignaturesValidation

public void processSignaturesValidation(List<AdvancedSignature> allSignatureList)

Description copied from interface: DocumentValidator

This method process the signature validation on the given allSignatureList

Specified by:

processSignaturesValidation in interface DocumentValidator

Parameters:

allSignatureList - list of AdvancedSignatures to be validated

findSignatureScopes

public void findSignatureScopes(List<AdvancedSignature> allSignatures)

Finds and assigns SignatureScopes for a list of signatures

Specified by:

findSignatureScopes in interface DocumentValidator

Parameters:

allSignatures - a list of AdvancedSignatures to get a SignatureScope list

setSkipValidationContextExecution

public void setSkipValidationContextExecution(boolean skipValidationContextExecution)

setLocale

public void setLocale(Locale locale)