Summary

Disable the XPath Transform in XML Signatures.

Problem

The XPath Transform is rarely used, introduces complexity, and is not recommended by the XML Signature Best Practices document. Applications should use the XPath Transform 2.0 Filter instead, which was designed to be an alternative to the XPath Transform. We should disable the XPath Transform by default.

Solution

Disable the XPath Transform in XML Signatures by adding it to the jdk.xml.dsig.secureValidationPolicy security property in the java.security configuration file.

Specification

diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security
index b115d479838..98c752c4aa3 100644
--- a/src/java.base/share/conf/security/java.security
+++ b/src/java.base/share/conf/security/java.security
@@ -1005,20 +1005,21 @@ crypto.policy=crypto.policydir-tbd
 jdk.xml.dsig.secureValidationPolicy=\
     disallowAlg http://www.w3.org/TR/1999/REC-xslt-19991116,\
     disallowAlg http://www.w3.org/2001/04/xmldsig-more#rsa-md5,\
     disallowAlg http://www.w3.org/2001/04/xmldsig-more#hmac-md5,\
     disallowAlg http://www.w3.org/2001/04/xmldsig-more#md5,\
     disallowAlg http://www.w3.org/2000/09/xmldsig#sha1,\
     disallowAlg http://www.w3.org/2000/09/xmldsig#dsa-sha1,\
     disallowAlg http://www.w3.org/2000/09/xmldsig#rsa-sha1,\
     disallowAlg http://www.w3.org/2007/05/xmldsig-more#sha1-rsa-MGF1,\
     disallowAlg http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1,\
+    disallowAlg http://www.w3.org/TR/1999/REC-xpath-19991116,\
     maxTransforms 5,\
     maxReferences 30,\
     disallowReferenceUriSchemes file http https,\
     minKeySize RSA 1024,\
     minKeySize DSA 1024,\
     minKeySize EC 224,\
     noDuplicateIds,\
     noRetrievalMethodLoops