TIKA-2856 - follow on from TIKA-1997 (#2960)

Author: tballison

tika-core/src/main/resources/org/apache/tika/mime/tika-mimetypes.xml

@@ -909,26 +909,15 @@
     <magic priority="50">
       <!-- PEM encoded -->
       <match value="-----BEGIN PKCS7" type="string" offset="0"/>
-      <!-- DER encoded, sequence+length, object=pkcs7-signedData -->
-      <match value="0x3080" offset="0">
-         <match value="0x06092a864886f70d0107FFa0" type="string"
-                 mask="0xFFFFFFFFFFFFFFFFFFFF00FF" offset="2"/>
-      </match>
-      <match value="0x3081" offset="0">
-         <match value="0x06092a864886f70d0107FFa0" type="string"
-                 mask="0xFFFFFFFFFFFFFFFFFFFF00FF" offset="3"/>
-      </match>
-      <match value="0x3082" offset="0">
-         <match value="0x06092a864886f70d0107FFa0" type="string"
-                 mask="0xFFFFFFFFFFFFFFFFFFFF00FF" offset="4"/>
-      </match>
-      <match value="0x3083" offset="0">
-         <match value="0x06092a864886f70d0107FFa0" type="string"
-                 mask="0xFFFFFFFFFFFFFFFFFFFF00FF" offset="5"/>
-      </match>
-      <match value="0x3084" offset="0">
+      <!-- DER encoded: SEQUENCE then a CMS ContentInfo whose contentType is in the pkcs7 arc
+           1.2.840.113549.1.7.x (signedData .2, envelopedData .3, digestedData .5, encryptedData .6,
+           ... last OID byte masked) followed by the [0] content tag (a0). offset 2:6 spans the DER
+           SEQUENCE length forms (short-form + 80/81/82/83/84), so small short-form containers such
+           as a bare digestedData are matched too. This is the coarse family label; Pkcs7Parser
+           refines the exact smime-type. -->
+      <match value="0x30" offset="0">
          <match value="0x06092a864886f70d0107FFa0" type="string"
-                 mask="0xFFFFFFFFFFFFFFFFFFFF00FF" offset="6"/>
+                 mask="0xFFFFFFFFFFFFFFFFFFFF00FF" offset="2:6"/>
       </match>
     </magic>
   </mime-type>

tika-parsers/tika-parsers-standard/tika-parsers-standard-modules/tika-parser-crypto-module/src/test/java/org/apache/tika/parser/crypto/Pkcs7DetectionTest.java

@@ -50,5 +50,7 @@ public void testContentOnlyDetection() throws Exception {
         // existing masked CMS magic detects signed/enveloped coarsely as pkcs7-signature by content
         assertEquals("application/pkcs7-signature", detect("testPKCS7_signed_data_def.p7m"));
         assertEquals("application/pkcs7-signature", detect("testPKCS7_enveloped_def.p7m"));
+        // TIKA-2856: a short-form-length digestedData is now caught coarsely (routes to Pkcs7Parser)
+        assertEquals("application/pkcs7-signature", detect("testPKCS7_digested.p7"));
     }
 }

tika-parsers/tika-parsers-standard/tika-parsers-standard-modules/tika-parser-crypto-module/src/test/java/org/apache/tika/parser/crypto/Pkcs7ParserTest.java

@@ -57,6 +57,9 @@ public void testSubtypeRefinement() throws Exception {
                 parsedType("testPKCS7_compressed_def_long.p7z"));
         assertEquals("application/pkcs7-mime; smime-type=compressed-data",
                 parsedType("testPKCS7_compressed_ind.p7z"));
+        // TIKA-2856: digestedData refined at parse time (coarse magic now routes it here)
+        assertEquals("application/pkcs7-mime; smime-type=digested-data",
+                parsedType("testPKCS7_digested.p7"));
     }
 
     /** Detached signatures are labelled pkcs7-signature and no longer throw. */