open-eid / cdoc4j Goto Github PK

• Create possibility to decrypt container in memory
  Example of the decrypt return type:
  ListOf(
  DataFile{
  String name,
  long size,
  String mimeType, // NB! Should be introduced. Mime type of the file was added to the container
  Date creationDate, // creation date of the file was added to the container (if possible)
  byte[] body; //
  });

Proposal: We can create 2 types of DataFile objects, one is read once, and another is read multiple times.

Decryption of CDOC 1.0 container encrypted by JDigiDoc 3.12.0-785 results with broken datafile content. E.g decryption works without errors, however the org.openeid.cdoc4j.DataFile content differs from the expected.
The decryption of the same cdoc container using JDigiDoc 3.x library works fine.

CDOC Library used for decryption: org.open-eid.cdoc4j 1.3.

Container and algorithm details:

...
</denc:CipherValue></denc:CipherData>denc:EncryptionProperties<denc:EncryptionProperty Name="LibraryVersion">JDigiDoc|3.12.0-785</denc:EncryptionProperty><denc:EncryptionProperty Name="DocumentFormat">ENCDOC-XML|1.0</denc:EncryptionProperty><denc:EncryptionProperty Name="Filename">XX-response.xml</denc:EncryptionProperty><denc:EncryptionProperty Name="OriginalMimeType">text/xml</denc:EncryptionProperty><denc:EncryptionProperty Name="OriginalSize">8843</denc:EncryptionProperty></denc:EncryptionProperties></denc:EncryptedData>

java.nio.file package is supported on API levels 26+.
https://developer.android.com/reference/java/nio/file/package-summary

https://github.com/open-eid/cdoc4j/blob/master/src/main/java/org/openeid/cdoc4j/CDOCBuilder.java#L99
Should implement this method without using classes in java.nio.file package.

Upgrade Bouncy Castle Java Cryptography API dependencies to 1.64. CVE-2018-1000613.