From bb01cb824472894f93a1a01aa28b8ad44156f59f Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Wed, 27 Nov 2013 11:02:40 +0000
Subject: [PATCH] Add a parent bean for SHA-1-intolerant XML signature
 validation.

---
 mdx/common-beans.xml | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/mdx/common-beans.xml b/mdx/common-beans.xml
index d7038ba6..3876bafd 100644
--- a/mdx/common-beans.xml
+++ b/mdx/common-beans.xml
@@ -100,6 +100,29 @@
         </property>
         <property name="permittingEmptyReferences" value="false"/>
     </bean>
+    
+    <!--
+        XMLSignatureValidationStageSHA256
+        
+        Parent for XML signature validation stages where we know
+        the signature will not be made with MD5 or SHA-1.
+    -->
+    <bean id="XMLSignatureValidationStageSHA256" abstract="true"
+        parent="XMLSignatureValidationStage">
+        <property name="blacklistedDigests">
+            <list>
+                <value>http://www.w3.org/2000/09/xmldsig#sha1</value>
+                <value>http://www.w3.org/2001/04/xmldsig-more#md5</value>
+            </list>
+        </property>
+        <property name="blacklistedSignatureMethods">
+            <list>
+                <value>http://www.w3.org/2000/09/xmldsig#rsa-sha1</value>
+                <value>http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1</value>
+                <value>http://www.w3.org/2001/04/xmldsig-more#rsa-md5</value>
+            </list>
+        </property>
+    </bean>
 
     <!--
         XSLTransformationStage