ContentInfo content = new ContentInfo(new Oid("1.2.840.113549.1.7.5"), Encoding.UTF8.GetBytes(str.ToString()));
SignedCms signedCms = new SignedCms(content, true);
CmsSigner cmsSigner = new CmsSigner(cert);
cmsSigner.IncludeOption = X509IncludeOption.EndCertOnly;
cmsSigner.DigestAlgorithm = new Oid("2.16.840.1.101.3.4.2.1");
cmsSigner.SignerIdentifierType = SubjectIdentifierType.IssuerAndSerialNumber;
Pkcs9AttributeObject att = new Pkcs9AttributeObject();
AsnEncodedData data = new AsnEncodedData(new SHA1Managed().ComputeHash(cert.RawData));
cmsSigner.SignedAttributes.Add(new Pkcs9SigningTime(DateTime.UtcNow));
//cmsSigner.SignedAttributes.Add(new Pkcs9ContentType());
//cmsSigner.SignedAttributes.Add(new Pkcs9MessageDigest());
signedCms.ComputeSignature(cmsSigner);
return Convert.ToBase64String(signedCms.Encode());
I have used this code to sign a document and this code is working fine but my problem is that there is another requirement needed to add "SigningCertificateV2" attribute as a signed attribute...
I have already added ContentType, MessageDigest and SigningTime. But i dont know how to add "SigningCertificateV2" attribute.. (1.2.840.113549.1.9.16.2.47)
Can You please help me with this?
(It seems this question's been sitting unanswered for more than a year and a half, so I really hope Asharf managed to comply with the new requirement somehow. There's been more than 300 views though, so hopefully a late answer would still be helpful.)
The types in System.Security.Cryptography.Pkcs do not provide support for the full range of attributes defined by various Cryptographic Message Syntax (CMS) specs like CMS Advanced Electronic Signatures (CAdES) and Enhanced Security Services Update (ESSCertIdUpdate), but only for the most commonly used attribs like Pkcs9ContentType, Pkcs9MessageDigest, Pkcs9SigningTime, etc.
Specifically, there's no "strongly-typed" wrapper around the SigningCertificatev2 attribute, defined by ESSCertIdUpdate (RFC 5035). In that case, one has to use the "generic" CryptographicAttributeObject type and construct the ASN.1 encoded data for the attribute "by hand", that is, concoct a raw byte[], typically by using System.Formats.Asn1.AsnWriter (and thoroughly reading the relevant RFC -- that's always a good idea, btw).
Defining a wrapper for the SigningCertificatev2 attrib requires a fair amount of code as several other related RFC types like ESSCertIDv2 and PolicyInformation need also be defined.
Luckily, there's a well-known open-source software project that already does exactly that -- it can be used for "inspiration" ;-). That's NuGet, and specifically the NuGet client.
(I know link-only answers are frowned upon on SO, but I guess a link-mostly answer is better than no answer, so here goes...).
Here are the links to the relevant parts in the GutHub repo.
CreateSigningCertificateV2() in AttributeUtility
The SigningCertificateV2 type itself.
The EssCertIdV2 type, used by SigningCertificateV2.
The NuGet client's attribute implementation can't be used directly as a library, but it should provide a nice guideline about how to construct the PKCS attribute.
Related
I am developing an ePub. In the content.opf file I have to specify a series of metadata by using DC standard. For example dc:title and dc:creator.
However my book is a multilanguage book, that is, it contains two translations of the same text: English and Russian. The standard reference manual states that I can have more dc:language statements. For example:
<dc:language>en</dc:language>
<dc:language>ru</dc:language>
but it does not say how to specify the other metadata for more than one language. Consider, for example, dc:creator. I tried
<dc:creator xml:lang="en">Dario de Judicibus</dc:creator>
<dc:creator xml:lang="ru">Дарио де Юдицибус</dc:creator>
I get an error from the distribution platform validator, which states that the format of ePub is not correct. It looks like I cannot use xml:lang in dc:creator even if, in theory, that is an XML attribute that can be used with any XML tag. Same for dc:title:
<dc:title xml:lang="en">My Book Title</dc:title>
<dc:title xml:lang="ru">Название Mоей Kниги</dc:title>
Could someone who has had to face the same problem as me, namely writing the OPF for an ePub that contains a text in multiple languages, tell me what is the correct way to do it? In the standards for the OPF 3.x I have not been able to find any useful information to establish this.
SOLVED
I verified my code with one of the author of the W3C specifications for OPF and he told me that what I wrote is correct, but that some validator is not used to multi-language documents, so that the problem is the validator, not the code. I write this in case someone else may have the same problem.
How to set a fixed width for columns in mjml?
I do not want to have classes or media queries for columns. I just want the columns to have a fixed width and I want that width to be a part of inlined styles for a column.
I need this, because, during forwarding Outlook removes all the classes and the classes which specify width for columns get stripped off as well. Also, I do not care about responsiveness.
If it is ambiguous whether you've used mj-column > width, I should suggest that as the first step. Perhaps you've used it.
Paradoxically, I'll suggest using mj-style inline="inline". In your MJML, target the HTML element you need using the technique suggested in https://documentation.mjml.io/#mj-html-attributes and Difficulty in understanding CSS-styling in MJML
If I understand your use case right, you need to get the necessary HTML attributes inside the HTML elements. MJML will put yours there because of the inline="inline" instruction above. That's the first HTML, the file MJML creates. With luck, the email client doing the forwarding won't change that. Maybe no client will change those; test carefully.
Your use case is challenging. Meeting the challenge of creating a generally forwardable email is huge; it's tough to know all possible modifications made at any one export or import at an email client, let alone the combined effect of combinations of clients. MJML typically makes email authors more efficient in getting email into all email clients the first time; MJML doesn't try to support forwarding. Each forward requires an export from the first email client and an import into the second. See https://www.litmus.com/blog/when-forwarded-emails-break/
BTW: In addition to StackOverflow, a great source of MJML support is https://mjml.slack.com/ You probably would have gotten a more prompt response there than this one. (Sorry!)
I have been researching about this term for so many hours, but I found anything useful yet.
Hope you can help us building this redmine plugin, or provide us some research links to help us find the correct key.
What we want to build
The thing is we want to update one custom field in redmine (let's name it 'Target_CF') whenever another one is created or updated.
We are looking for incrementing possible values of Target_CF, so we can have all custom field's names available to select.
Of course, we want to achieve this without directly editing Redmine's Core, so we thought developing a plugin would be the best approach.
Our plugin also creates and configures a new custom field (the one mentioned above), but I will let this out of the question, because I think it is not relevant for this.
Where we are right now
We have identified some hooks that could be useful for us, as the following:
:controller_custom_fields_new_after_save
:controller_custom_fields_edit_after_save
We have the following directories/files structure so far:
plugins/
custom_plugin/
init.rb
lib/
hooks.rb
The code we have written
init.rb
require_dependency 'hooks'
Redmine::Plugin.register :custom_plugin do
name 'custom_plugin'
author 'author name'
description 'description text'
version '1.0.0'
end
hooks.rb
class Hooks < Redmine::Hook::ViewListener
def controller_custom_fields_edit_after_save(context={ })
#target_custom_field_name = "Target_CF"
CustomField.find_by_name(#target_custom_field_name).possible_values.push(context[:custom_field].name)
end
end
The result of this code is none. I mean, no erros, no updates, nothing at all. There is no change in our possible values after editing/creating another custom field. We are sure there is something we don't know, some concept or workflow, and due to this we are doing something so badly.
Please, help us understeand what we are missing.
Previously we have succesfully developed another plugin that overwrites certain views. So we have kind of little skills in views related plugins, but zero experience at all at controllers ones.
We are using a Redmine 3.2.0 stack by Bitnami and a mysql database.
Well, finally we found out how to extend base controller's methods. I will post it here so hopefully this can be useful to anyone who finds the same doubts we had.
After some more researching, we conclude that it is mandatory to extend base controllers, in order to not directly modify core methods.
This is our final directories/files structures:
plugins/
custom_plugin/
init.rb
lib/
custom_plugin/
issue_custom_field_patch.rb
We previously stated that we could use some hooks to inject our desired functionality, but it seems not to work that way with controllers. On the other hand, we built a patch which will extend target class functionality.
Our final working code
Init.rb
require 'redmine'
ActionDispatch::Callbacks.to_prepare do
require_dependency 'issue_custom_field'
unless IssueCustomField.included_modules.include? CustomPlugin::IssueCustomFieldPatch
IssueCustomField.send(:include, CustomPlugin::IssueCustomFieldPatch)
end
end
Redmine::Plugin.register :custom_plugin do
name 'custom_plugin'
author 'author name'
description 'description text'
version '1.0.0'
end
issue_custom_field_patch.rb
module CustomPlugin
module IssueCustomFieldPatch
def self.included(base) # :nodoc:
base.extend(ClassMethods)
base.send(:include, InstanceMethods)
base.class_eval do
unloadable
after_save :update_possible_values
end
end
end
module ClassMethods
end
module InstanceMethods
def update_possible_values
self.reload
updatedPossibleValues unless self.name == "Target_CF"
end
private
def updatedPossibleValues
#safe_attrs = ['project', 'description', 'due_date', 'category', 'status', 'assigned_to', 'priority', 'fixed_version', 'author', 'lock_version', 'created_on', 'updated_on', 'start_date', 'done_ratio', 'estimated_hours', 'is_private', 'closed_on']
#custom_fields = IssueCustomField.all.select {|cf| !cf[:position].nil?}.collect {|cf| cf.name}
#possible_values = #safe_attrs + #custom_fields
CustomField.find_by_name("Target_CF").update possible_values: #possible_values
end
end
CustomField.send(:include, IssueCustomFieldPatch)
end
Functionality explained
As we stated in the question, we needed to update Target_CF possible values each time the users create/modify/removes a custom field from Redmine.
We extended IssueCustomField's class's instance methods, triggering our new function 'updatedPossibleValues' after each save. This includes creating new custom fields, and of course, updating existing ones and removing them. Because we reload our list of possible values each time, we had to control if its position were nil. If it is, this means that custom field has been removed.
Because of the ultimate action of this patch, which is the updating of another custom field, this also triggered our function, causing an infinite loop. To prevent this, we linked our functionality to every other custom field which name was not 'Target_CF'. A bit rusty fix, but we couldn't find a better approach.
I hope this can be useful to somebody in the future, as they could invest a fraction of time that we spent on this.
Comments, fixes and improvements are very welcome.
Based on: https://www.redmine.org/projects/redmine/wiki/Plugin_Internals which is a bit outdated, but finally could complete the code with help of another resources and forums.
IS there a way to add/initate a comment ( e.g. $dom->createComment ... ) such that it comments out an entire block of xml tags. Basically I want to turn-off the content between the comment.
For example, it would look like this:
<TT>
<AA>keep</AA>
<!-- comment to blocking
<BB>hideme1</BB>
<CC>hideme2</CC>
-->
<DD>d's content is good</DD>
</TT>
Actually this question is a pre-cursor to my attempt to figure-out a method to be able to markup/label/identify the changes to an xml files in support of new client software functionality, but be able to have the ability to remove / back-out these xml changes in the rare event the client needs to fall back to the previous software version (and no I can't just simply point back to the original xml file because the client is allowed to make minor modifications to existing node text values). This is all going to be controlled via a perl script and LibXML's core modules (I can't use modules the client doesn't have).
So basically I've identified three possible types of xml changes as a result of new client sw functionality:
1.) ADD new element node(s) (typically to support new sw functionality)
2.) DELETE element node(s), or blocks of (would be rare, but never-the-less a possibility)
3.) CHANGE node text values (rare, but the new sw may require a new value)
For all three types, the client needs the ability to back out the changes. One thing I was thinking to use is ATTRIBUTES since the existing xml files don't use them. For example, for an ADD change type, I could include an atribute like 'ADD="sw version 4.1"' . This way if it needs to be removed, I could just simply have the perl script find those attribute strings and delete them (using LibXML methods). Same thing with CHANGE change type - I could use an attribute like CHG="newvalue_oldvalue", then again use straight perl (or LibXML) to switch back the value based on the contents of the attribute. The DELETE change type is giving me a problem though (as welll as the others lol!). I want to be able to "keep" the deleted lines in the xml file soley for the purposes if the sw falls back a version (at some late point the perl script could eventually cleanup/delete them).
I know this is a lot, I'm new to LibXML (but not to perl). I was just wonder if any of you have any thoughts as to how to go about it or seen anything resembling this kind of request ... I'd be grateful for any kind of advice! Thank you...
I have huge application written in ZendFramework. Earlier everything was fine.
As for now it was redesigned and received a lot of new functionalities and options, but I have to defend this software from xss.
Variables are taken from a couple sources (webform, Webservices, api, etc.), some of them should be escaped, some not.
What do you think, what will be the best method to defend my website, without editing all (2 000 +) files and escaping all echo's ?
Zend Framework comes with a class called "Zend_Filter". This class has a "StripTags" filter option that will strip all tags from a given string.
http://framework.zend.com/manual/en/zend.filter.set.html#zend.filter.set.striptags
If you note, even the strip tags filter isn't recommended for sanitizing input if you exclude something and it shouldn't be used to defend against XSS attacks. It recommends using Tidy or HTMLPurifier.
http://tidy.sourceforge.net/
http://htmlpurifier.org/
I think HTML Purifier is pretty easy to use. From their docs website:
require_once '/path/to/HTMLPurifier.auto.php';
$config = HTMLPurifier_Config::createDefault(); $purifier = new
HTMLPurifier($config); $clean_html = $purifier->purify($dirty_html);
I hope that helps!
Cheers!