Pkcs7Parser.java
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.apache.tika.parser.crypto;
import java.io.IOException;
import java.io.InputStream;
import java.nio.file.Files;
import java.util.Set;
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
import org.bouncycastle.cms.CMSCompressedDataParser;
import org.bouncycastle.cms.CMSException;
import org.bouncycastle.cms.CMSSignedDataParser;
import org.bouncycastle.cms.CMSTypedStream;
import org.bouncycastle.cms.jcajce.ZlibExpanderProvider;
import org.bouncycastle.operator.DigestCalculatorProvider;
import org.bouncycastle.operator.OperatorCreationException;
import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
import org.xml.sax.ContentHandler;
import org.xml.sax.SAXException;
import org.apache.tika.annotation.TikaComponent;
import org.apache.tika.exception.TikaException;
import org.apache.tika.io.BoundedInputStream;
import org.apache.tika.io.TikaInputStream;
import org.apache.tika.metadata.Metadata;
import org.apache.tika.metadata.TikaCoreProperties;
import org.apache.tika.mime.MediaType;
import org.apache.tika.parser.EmptyParser;
import org.apache.tika.parser.ParseContext;
import org.apache.tika.parser.Parser;
import org.apache.tika.sax.XHTMLContentHandler;
/**
* Parser for PKCS7/CMS data. Refines the content type to the CMS subtype (illustrator-style:
* coarse magic routes here, this parser sets the {@code smime-type}) and extracts the embedded
* content of a signed-data message. Non-signed or detached messages are labelled but not
* extracted (their payload is absent, encrypted, or unsupported) and never throw.
*/
@TikaComponent
public class Pkcs7Parser implements Parser {
private static final long serialVersionUID = -7310531559075115044L;
private static final MediaType PKCS7_MIME = MediaType.application("pkcs7-mime");
private static final MediaType PKCS7_SIGNATURE = MediaType.application("pkcs7-signature");
private static final Set<MediaType> SUPPORTED_TYPES =
MediaType.set(PKCS7_MIME, PKCS7_SIGNATURE);
// cap the inflated output of a CMS compressedData so a zlib bomb (tiny compressed -> huge
// output) can't blow up the parse; content beyond this is dropped
private static final long MAX_DECOMPRESSED = 100L * 1024 * 1024;
public Set<MediaType> getSupportedTypes(ParseContext context) {
return SUPPORTED_TYPES;
}
public void parse(TikaInputStream tis, ContentHandler handler, Metadata metadata,
ParseContext context) throws IOException, SAXException, TikaException {
tis.setCloseShield();
try {
// route on the cheap ContentInfo OID; signedData is then parsed exactly once (in
// parseSignedData), which both labels the subtype and extracts the payload
ASN1ObjectIdentifier oid = CmsClassifier.contentType(tis);
if (PKCSObjectIdentifiers.signedData.equals(oid)) {
parseSignedData(tis, handler, metadata, context);
} else if (PKCSObjectIdentifiers.id_ct_compressedData.equals(oid)) {
metadata.set(Metadata.CONTENT_TYPE, CmsClassifier.COMPRESSED.toString());
extractCompressedContent(tis, handler, metadata, context);
} else {
// enveloped / digested / encrypted (labelled; payload absent, encrypted, or
// unsupported) or unknown / non-CMS -> empty doc, no throw
MediaType type = CmsClassifier.nonSignedType(oid);
if (type != null) {
metadata.set(Metadata.CONTENT_TYPE, type.toString());
}
emptyDocument(handler, metadata);
}
} finally {
tis.removeCloseShield();
}
}
/** Parse a signedData message once: set the refined subtype and extract the embedded payload if present. */
private void parseSignedData(TikaInputStream tis, ContentHandler handler, Metadata metadata,
ParseContext context)
throws IOException, SAXException, TikaException {
try (InputStream is = Files.newInputStream(tis.getPath())) {
DigestCalculatorProvider digestCalculatorProvider =
new JcaDigestCalculatorProviderBuilder().setProvider("BC").build();
CMSSignedDataParser parser = new CMSSignedDataParser(digestCalculatorProvider, is);
try {
CMSTypedStream content = parser.getSignedContent();
metadata.set(Metadata.CONTENT_TYPE,
CmsClassifier.refinedSignedType(parser, content).toString());
if (content != null) {
try (TikaInputStream contentTis = TikaInputStream.get(content.getContentStream())) {
Parser delegate = context.get(Parser.class, EmptyParser.INSTANCE);
delegate.parse(contentTis, handler, Metadata.newInstance(context), context);
}
} else {
emptyDocument(handler, metadata); // detached / certs-only: nothing to extract
}
} finally {
parser.close();
}
} catch (OperatorCreationException e) {
throw new TikaException("Unable to create DigestCalculatorProvider", e);
} catch (CMSException e) {
throw new TikaException("Unable to parse pkcs7 signed data", e);
}
}
/** Inflate CMS compressedData (RFC 3274, zlib) and delegate-parse the inner payload. */
private void extractCompressedContent(TikaInputStream tis, ContentHandler handler,
Metadata metadata, ParseContext context)
throws IOException, SAXException, TikaException {
try (InputStream is = Files.newInputStream(tis.getPath())) {
CMSCompressedDataParser parser = new CMSCompressedDataParser(is);
CMSTypedStream content = parser.getContent(new ZlibExpanderProvider());
BoundedInputStream inflated =
new BoundedInputStream(MAX_DECOMPRESSED, content.getContentStream());
try (TikaInputStream contentTis = TikaInputStream.get(inflated)) {
Parser delegate = context.get(Parser.class, EmptyParser.INSTANCE);
delegate.parse(contentTis, handler, Metadata.newInstance(context), context);
}
if (inflated.hasHitBound()) {
// zlib-bomb guard tripped: the payload was truncated at MAX_DECOMPRESSED, so record
// a non-fatal warning rather than let a partial extraction look complete
metadata.add(TikaCoreProperties.TIKA_META_EXCEPTION_WARNING,
"CMS compressedData payload exceeded " + MAX_DECOMPRESSED +
" bytes and was truncated");
}
} catch (CMSException e) {
throw new TikaException("Unable to parse pkcs7 compressed data", e);
}
}
private void emptyDocument(ContentHandler handler, Metadata metadata) throws SAXException {
XHTMLContentHandler xhtml = new XHTMLContentHandler(handler, metadata);
xhtml.startDocument();
xhtml.endDocument();
}
}