Weak Cryptographic Signature: XML Signature Secure Validation Disabled

The code disables XML Signature secure validation.

The XML Signature secure validation mode enables the validation of XML digital signatures and restricts several XML constructs to avoid some Denial of Service and other types of attacks.

Such restrictions include:
- Forbids the use of XSLT transforms.
- Restricts the number of SignedInfo or Manifest Reference elements to 30 or less.
- Restricts the number of Reference transforms to 5 or less.
- Forbids the use of MD5 signatures or MD5 MAC algorithms.
- Ensures that Reference IDs are unique to help prevent signature wrapping attacks.
- Forbids Reference URIs of type http, https, or file.
- Does not allow a RetrievalMethod element to reference another RetrievalMethod element.
- Forbids RSA or DSA keys less than 1024 bits.
- Forbids EC keys less than 224 bits.

Example 1: The following code disables XML Signature secure validation with a system property:

Properties props = System.getProperties();
...
properties.setProperty("org.jcp.xml.dsig.secureValidation", "false");

Example 2: The following code disables XML Signature secure validation with XMLCryptoContext.setProperty:

DOMCryptoContext cryptoContext = new DOMCryptoContext() {...};
...
cryptoContext.setProperty("org.jcp.xml.dsig.secureValidation", false);