Skip to content
Snippets Groups Projects
Commit a078928c authored by Olav Morken's avatar Olav Morken
Browse files

xmlseclibs: Fix processing of references with URI="" and URI="#..." with a...

xmlseclibs: Fix processing of references with URI="" and URI="#..." with a WithComments canonicalization.


git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@774 44740490-163a-0410-bde0-09ae8108e29a
parent cf8122a5
No related branches found
No related tags found
No related merge requests found
...@@ -714,7 +714,7 @@ class XMLSecurityDSig { ...@@ -714,7 +714,7 @@ class XMLSecurityDSig {
return ($digValue == $digestValue); return ($digValue == $digestValue);
} }
public function processTransforms($refNode, $objData) { public function processTransforms($refNode, $objData, $includeCommentNodes = TRUE) {
$data = $objData; $data = $objData;
$xpath = new DOMXPath($refNode->ownerDocument); $xpath = new DOMXPath($refNode->ownerDocument);
$xpath->registerNamespace('secdsig', XMLSecurityDSig::XMLDSIGNS); $xpath->registerNamespace('secdsig', XMLSecurityDSig::XMLDSIGNS);
...@@ -728,6 +728,16 @@ class XMLSecurityDSig { ...@@ -728,6 +728,16 @@ class XMLSecurityDSig {
switch ($algorithm) { switch ($algorithm) {
case 'http://www.w3.org/2001/10/xml-exc-c14n#': case 'http://www.w3.org/2001/10/xml-exc-c14n#':
case 'http://www.w3.org/2001/10/xml-exc-c14n#WithComments': case 'http://www.w3.org/2001/10/xml-exc-c14n#WithComments':
if(!$includeCommentNodes) {
/* We remove comment nodes by forcing it to use a canonicalization
* without comments.
*/
$canonicalMethod = 'http://www.w3.org/2001/10/xml-exc-c14n#';
} else {
$canonicalMethod = $algorithm;
}
$node = $transform->firstChild; $node = $transform->firstChild;
while ($node) { while ($node) {
if ($node->localName == 'InclusiveNamespaces') { if ($node->localName == 'InclusiveNamespaces') {
...@@ -748,9 +758,18 @@ class XMLSecurityDSig { ...@@ -748,9 +758,18 @@ class XMLSecurityDSig {
} }
$node = $node->nextSibling; $node = $node->nextSibling;
} }
break;
case 'http://www.w3.org/TR/2001/REC-xml-c14n-20010315': case 'http://www.w3.org/TR/2001/REC-xml-c14n-20010315':
case 'http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments': case 'http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments':
$canonicalMethod = $algorithm; if(!$includeCommentNodes) {
/* We remove comment nodes by forcing it to use a canonicalization
* without comments.
*/
$canonicalMethod = 'http://www.w3.org/TR/2001/REC-xml-c14n-20010315';
} else {
$canonicalMethod = $algorithm;
}
break; break;
case 'http://www.w3.org/TR/1999/REC-xpath-19991116': case 'http://www.w3.org/TR/1999/REC-xpath-19991116':
$node = $transform->firstChild; $node = $transform->firstChild;
...@@ -780,10 +799,23 @@ class XMLSecurityDSig { ...@@ -780,10 +799,23 @@ class XMLSecurityDSig {
public function processRefNode($refNode) { public function processRefNode($refNode) {
$dataObject = NULL; $dataObject = NULL;
/*
* Depending on the URI, we may not want to include comments in the result
* See: http://www.w3.org/TR/xmldsig-core/#sec-ReferenceProcessingModel
*/
$includeCommentNodes = TRUE;
if ($uri = $refNode->getAttribute("URI")) { if ($uri = $refNode->getAttribute("URI")) {
$arUrl = parse_url($uri); $arUrl = parse_url($uri);
if (empty($arUrl['path'])) { if (empty($arUrl['path'])) {
if ($identifier = $arUrl['fragment']) { if ($identifier = $arUrl['fragment']) {
/* This reference identifies a node with the given id by using
* a URI on the form "#identifier". This should not include comments.
*/
$includeCommentNodes = FALSE;
$xPath = new DOMXPath($refNode->ownerDocument); $xPath = new DOMXPath($refNode->ownerDocument);
if ($this->idNS && is_array($this->idNS)) { if ($this->idNS && is_array($this->idNS)) {
foreach ($this->idNS AS $nspf=>$ns) { foreach ($this->idNS AS $nspf=>$ns) {
...@@ -805,9 +837,14 @@ class XMLSecurityDSig { ...@@ -805,9 +837,14 @@ class XMLSecurityDSig {
$dataObject = file_get_contents($arUrl); $dataObject = file_get_contents($arUrl);
} }
} else { } else {
/* This reference identifies the root node with an empty URI. This should
* not include comments.
*/
$includeCommentNodes = FALSE;
$dataObject = $refNode->ownerDocument; $dataObject = $refNode->ownerDocument;
} }
$data = $this->processTransforms($refNode, $dataObject); $data = $this->processTransforms($refNode, $dataObject, $includeCommentNodes);
if (!$this->validateDigest($refNode, $data)) { if (!$this->validateDigest($refNode, $data)) {
return FALSE; return FALSE;
} }
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment