Resolve dsig11:DEREncodedKeyValue on the StAX inbound path

src/main/java/org/apache/xml/security/keys/content/DEREncodedKeyValue.java

@@ -121,8 +121,11 @@ public PublicKey getPublicKey() throws XMLSecurityException {
                 if (publicKey != null) {
                     return publicKey;
                 }
-            } catch (NoSuchAlgorithmException | InvalidKeySpecException e) { //NOPMD
-                // Do nothing, try the next type
+            } catch (NoSuchAlgorithmException | InvalidKeySpecException | RuntimeException e) { //NOPMD
+                // Do nothing, try the next type. Some providers (e.g. BouncyCastle's XDH/EdDSA
+                // KeyFactorySpi) throw an unchecked exception such as ArrayIndexOutOfBoundsException
+                // instead of InvalidKeySpecException for malformed or short input, which must not
+                // propagate since the encoded key here is untrusted, attacker-controlled content.
             }
         }
         throw new XMLSecurityException("DEREncodedKeyValue.UnsupportedEncodedKey");

src/main/java/org/apache/xml/security/stax/impl/securityToken/DEREncodedKeyValueSecurityToken.java

@@ -0,0 +1,99 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.xml.security.stax.impl.securityToken;
+
+import java.security.KeyFactory;
+import java.security.NoSuchAlgorithmException;
+import java.security.PublicKey;
+import java.security.spec.InvalidKeySpecException;
+import java.security.spec.X509EncodedKeySpec;
+
+import org.apache.xml.security.binding.xmldsig11.DEREncodedKeyValueType;
+import org.apache.xml.security.exceptions.XMLSecurityException;
+import org.apache.xml.security.stax.ext.InboundSecurityContext;
+import org.apache.xml.security.stax.impl.util.IDGenerator;
+import org.apache.xml.security.stax.securityToken.SecurityTokenConstants;
+
+/**
+ * Inbound security token for a {@code dsig11:DEREncodedKeyValue}: the DER-encoded
+ * SubjectPublicKeyInfo of a public key, which is the KeyValue form for key types that have no
+ * structured KeyValue element (ML-DSA, EdDSA, ...). The StAX counterpart of the DOM
+ * {@code DEREncodedKeyValue} support; the public key is rebuilt lazily from the encoding by
+ * trying each supported key type's {@link KeyFactory}.
+ */
+public class DEREncodedKeyValueSecurityToken extends AbstractInboundSecurityToken {
+
+    // Same key types as the DOM DEREncodedKeyValue.supportedKeyTypes
+    private static final String[] SUPPORTED_KEY_TYPES = { "RSA", "DSA", "EC",
+            "DiffieHellman", "DH", "XDH", "X25519", "X448",
+            "EdDSA", "Ed25519", "Ed448",
+            "ML-DSA-44", "ML-DSA-65", "ML-DSA-87",
+            "RSASSA-PSS"};
+
+    private final byte[] encodedKey;
+
+    public DEREncodedKeyValueSecurityToken(DEREncodedKeyValueType derEncodedKeyValueType,
+                                           InboundSecurityContext inboundSecurityContext)
+            throws XMLSecurityException {
+        super(inboundSecurityContext, IDGenerator.generateID(null), SecurityTokenConstants.KeyIdentifier_KeyValue, true);
+
+        byte[] value = derEncodedKeyValueType.getValue();
+        if (value == null || value.length == 0) {
+            throw new XMLSecurityException("stax.unsupportedKeyValue");
+        }
+        this.encodedKey = value.clone();
+    }
+
+    private PublicKey buildPublicKey() throws XMLSecurityException {
+        X509EncodedKeySpec keySpec = new X509EncodedKeySpec(encodedKey);
+        for (String keyType : SUPPORTED_KEY_TYPES) {
+            try {
+                PublicKey publicKey = KeyFactory.getInstance(keyType).generatePublic(keySpec);
+                if (publicKey != null) {
+                    return publicKey;
+                }
+            } catch (NoSuchAlgorithmException | InvalidKeySpecException | RuntimeException e) { //NOPMD
+                // Not this key type; try the next one. Some providers (e.g. BouncyCastle's
+                // XDH/EdDSA KeyFactorySpi) throw an unchecked exception such as
+                // ArrayIndexOutOfBoundsException instead of InvalidKeySpecException for
+                // malformed or short input, which must not propagate since encodedKey here is
+                // untrusted, attacker-controlled inbound content.
+            }
+        }
+        throw new XMLSecurityException("stax.unsupportedKeyValue");
+    }
+
+    @Override
+    public PublicKey getPublicKey() throws XMLSecurityException {
+        if (super.getPublicKey() == null) {
+            setPublicKey(buildPublicKey());
+        }
+        return super.getPublicKey();
+    }
+
+    @Override
+    public boolean isAsymmetric() {
+        return true;
+    }
+
+    @Override
+    public SecurityTokenConstants.TokenType getTokenType() {
+        return SecurityTokenConstants.KeyValueToken;
+    }
+}

src/main/java/org/apache/xml/security/stax/impl/securityToken/SecurityTokenFactoryImpl.java

@@ -33,6 +33,7 @@
 import org.apache.xml.security.binding.xmldsig.RSAKeyValueType;
 import org.apache.xml.security.binding.xmldsig.X509DataType;
 import org.apache.xml.security.binding.xmldsig.X509IssuerSerialType;
+import org.apache.xml.security.binding.xmldsig11.DEREncodedKeyValueType;
 import org.apache.xml.security.binding.xmldsig11.ECKeyValueType;
 import org.apache.xml.security.exceptions.XMLSecurityException;
 import org.apache.xml.security.stax.ext.InboundSecurityContext;
@@ -76,6 +77,17 @@ public InboundSecurityToken getSecurityToken(KeyInfoType keyInfoType,
                 return getSecurityToken(keyValueType, securityProperties, inboundSecurityContext, keyUsage);
             }
 
+            // DEREncodedKeyValue as a direct KeyInfo child, the XML Signature 1.1 placement
+            // (the nested-in-KeyValue placement is handled in the KeyValue branch above)
+            final DEREncodedKeyValueType derEncodedKeyValueType = XMLSecurityUtils.getQNameType(
+                    keyInfoType.getContent(), XMLSecurityConstants.TAG_dsig11_DEREncodedKeyValue);
+            if (derEncodedKeyValueType != null) {
+                DEREncodedKeyValueSecurityToken token =
+                        new DEREncodedKeyValueSecurityToken(derEncodedKeyValueType, inboundSecurityContext);
+                setTokenKey(securityProperties, keyUsage, token);
+                return token;
+            }
+
             // KeyName
             final String keyName =
                     XMLSecurityUtils.getQNameType(keyInfoType.getContent(), XMLSecurityConstants.TAG_dsig_KeyName);
@@ -165,6 +177,14 @@ private static InboundSecurityToken getSecurityToken(KeyValueType keyValueType,
             setTokenKey(securityProperties, keyUsage, token);
             return token;
         }
+        final DEREncodedKeyValueType derEncodedKeyValueType =
+                XMLSecurityUtils.getQNameType(keyValueType.getContent(), XMLSecurityConstants.TAG_dsig11_DEREncodedKeyValue);
+        if (derEncodedKeyValueType != null) {
+            DEREncodedKeyValueSecurityToken token =
+                    new DEREncodedKeyValueSecurityToken(derEncodedKeyValueType, inboundSecurityContext);
+            setTokenKey(securityProperties, keyUsage, token);
+            return token;
+        }
         throw new XMLSecurityException("stax.unsupportedKeyValue");
     }
 

src/test/java/org/apache/xml/security/test/dom/keys/DEREncodedKeyValueMalformedContentTest.java

@@ -0,0 +1,80 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.xml.security.test.dom.keys;
+
+import java.security.Provider;
+import java.security.Security;
+
+import org.apache.xml.security.exceptions.XMLSecurityException;
+import org.apache.xml.security.keys.content.DEREncodedKeyValue;
+import org.apache.xml.security.test.dom.TestUtils;
+import org.junit.jupiter.api.Test;
+import org.w3c.dom.Document;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assumptions.assumeTrue;
+
+/**
+ * {@link DEREncodedKeyValue#getPublicKey()} resolves the key by trying each supported key type's
+ * {@code KeyFactory}. Some providers throw an unchecked exception for malformed or short input
+ * instead of {@code InvalidKeySpecException} - notably BouncyCastle 1.85's XDH/EdDSA
+ * KeyFactorySpi throws {@code ArrayIndexOutOfBoundsException}. Since a DEREncodedKeyValue read
+ * from an inbound document (via {@code DEREncodedKeyValueResolver}, a default KeyResolver) is
+ * untrusted, attacker-controlled content, such an exception must not propagate out of key
+ * resolution.
+ *
+ * <p>The unchecked exception is only observed when BouncyCastle is the provider selected for
+ * XDH/EdDSA, i.e. registered ahead of the JDK's own providers (a common BouncyCastle-primary
+ * deployment). With the JDK providers taking precedence they reject the same input cleanly with
+ * {@code InvalidKeySpecException}, so this test inserts BouncyCastle at the first position (as
+ * {@code XMLCipherTest} does for its BouncyCastle-specific case) and is skipped when BouncyCastle
+ * is unavailable.
+ */
+class DEREncodedKeyValueMalformedContentTest {
+
+    @Test
+    void testMalformedDerContentRejectedCleanly() throws Exception {
+        boolean bcAtFirstPosition = false;
+        if (Security.getProvider("BC") == null) {
+            try {
+                Class<?> bcClass = Class.forName("org.bouncycastle.jce.provider.BouncyCastleProvider");
+                Provider bc = (Provider) bcClass.getConstructor().newInstance();
+                Security.insertProviderAt(bc, 1);
+                bcAtFirstPosition = true;
+            } catch (ReflectiveOperationException e) {
+                // BouncyCastle not installed, ignore
+            }
+        }
+        assumeTrue(bcAtFirstPosition, "requires BouncyCastle at first provider position");
+
+        try {
+            Document doc = TestUtils.newDocument();
+            // Bytes that decode to no valid SubjectPublicKeyInfo; short enough that BouncyCastle
+            // 1.85's XDH/EdDSA KeyFactory reads past the end (ArrayIndexOutOfBoundsException).
+            DEREncodedKeyValue derEncodedKeyValue =
+                    new DEREncodedKeyValue(doc, new byte[]{0, 1, 2, 3, 4, 5, 6, 7});
+
+            // Must fail cleanly with the declared XMLSecurityException, not an uncaught
+            // RuntimeException such as ArrayIndexOutOfBoundsException.
+            assertThrows(XMLSecurityException.class, derEncodedKeyValue::getPublicKey);
+        } finally {
+            Security.removeProvider("BC");
+        }
+    }
+}