search

dotnet / Open-XML-SDK

Open XML SDK by Microsoft
https://www.nuget.org/packages/DocumentFormat.OpenXml/
MIT License
4k stars 545 forks source link

Cloning a package breaks digital signatures. #1357

Open petarpetrovt opened 1 year ago

petarpetrovt commented 1 year ago

Describe the bug Cloning a package via OpenXmlPackage Clone(Stream stream) method breaks digital signatures.

Screenshots documentrels rels

To Reproduce

using var document = WordprocessingDocument.Open("valid.docx", isEditable: false);
using var clonedStream = File.Open("invalid.docx", FileMode.Create, FileAccess.ReadWrite);
using var clone = document.Clone(clonedStream);

Steps to reproduce the behavior:

  1. Create .docx file using Microsoft Word and add digital signature or signature line and sign it.
  2. Open via WordprocessingDocument and Clone into new file.

Observed behavior Some XML parts gets reordered, / added to Target attribute in Relationship URIs, standalone XML declaration is added some parts.

Expected behavior No changes should happen in part that are used in signature digests.

Desktop (please complete the following information):

twsouthwick commented 1 year ago

I'm not sure how much we can do with this as this is how System.IO.Packaging writes it out. I've recently inserted an abstraction between the main SDK and System.IO.Packaging, but we still rely on this behavior.

For background, the cloning is done by loading things and writing out to a new package. They are semantically cloned, but as you see, they do not have the same exact structure so signatures would not work. If that is necessary, I'd suggest clone them at the stream/file level first.