JDK-8254646 : Incorrect system resource file causing can not register URI http://www.w3.org/2007/05/xmldsig-more#ripemd160-rsa-MGF1
  • Type: Bug
  • Component: security-libs
  • Sub-Component: javax.xml.crypto
  • Affected Version: 8u231
  • Priority: P3
  • Status: Open
  • Resolution: Unresolved
  • Submitted: 2020-10-09
  • Updated: 2021-03-25
Description
A DESCRIPTION OF THE PROBLEM :
The resource file (/com/sun/org/apache/xml/internal/security/resource/config.xml) still contain signature algorithm: "http://www.w3.org/2007/05/xmldsig-more#ripemd160-rsa-MGF1"
==========
 <SignatureAlgorithm URI="http://www.w3.org/2007/05/xmldsig-more#ripemd160-rsa-MGF1"
JAVACLASS="com.sun.org.apache.xml.internal.security.algorithms.implementations.SignatureBaseRSA$SignatureRSARIPEMD160MGF1" />
==========

This issue also existed in JDK11.

but the implementation class: "SignatureRSARIPEMD160MGF1" had already removed from "com.sun.org.apache.xml.internal.security.algorithms.implementations.SignatureBaseRSA",  it cause the loader print error message.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Run the test code.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
No Error
ACTUAL -
Oct 09, 2020 4:33:00 PM com.sun.org.slf4j.internal.Logger error
SEVERE: Cannot register URI http://www.w3.org/2007/05/xmldsig-more#ripemd160-rsa-MGF1 to class com.sun.org.apache.xml.internal.security.algorithms.implementations.SignatureBaseRSA$SignatureRSARIPEMD160MGF1 because this class does not exist in CLASSPATH


---------- BEGIN SOURCE ----------
import com.sun.org.apache.xml.internal.security.Init;
import com.sun.org.apache.xml.internal.security.utils.I18n;

import java.util.Locale;

public class Test {
    public static void main(String[] args){
        System.setProperty("com.sun.org.apache.xml.internal.security.resource.config", "resource/config.xml");
        Locale locale = Locale.getDefault();
        I18n.init(locale.getLanguage(), locale.getCountry());
        Init.init();
    }
}
---------- END SOURCE ----------

FREQUENCY : always



Comments
See https://issues.apache.org/jira/browse/SANTUARIO-565.
25-03-2021

This is really a bug in the Apache Santuario Java implementation. I'll file a bug there and preferably we can pick up a fix for it when we incorporate the next version of Santuario into the JDK.
25-03-2021

The observations on Windows 10: JDK 8u231 : Failed with the error: Cannot register URI http://www.w3.org/2007/05/xmldsig-more#ripemd160-rsa-MGF1 to class....
25-11-2020

Not an i18n issue, assigning to security-libs.
14-10-2020

Received the modified test code from the submitter: import com.sun.org.apache.xml.internal.security.Init; import com.sun.org.apache.xml.internal.security.utils.I18n; import java.util.Locale; public class Test { public static void main(String[] args){ System.setProperty("com.sun.org.apache.xml.internal.security.resource.config", "resource/config.xml"); Locale locale = Locale.US; I18n.init(locale.getLanguage(), locale.getCountry()); Init.init(); } }
13-10-2020

Requested more details of reproducing steps from the submitter.
12-10-2020