search

moov-io / signedxml

pure go library for processing signed XML documents
MIT License
52 stars 44 forks source link

Fix broken signatures when attributes are prefixed with `xml` #20

Closed magnussuther closed 3 years ago

magnussuther commented 3 years ago

I noticed that the document signature is invalid if the document contains xml:lang attributes, i.e:

<mdui:DisplayName xml:lang="en">Example</mdui:DisplayName>

After some debugging I found the offending line in https://github.com/ma314smith/signedxml/blob/5961fe7b44fd9545cd43abb39777f5f6fab40705/exclusivecanonicalization.go#L212. This line causes the attribute xmlns:xml (without value) to be created in the in-memory version of the document at the time the digest is calculated.

This PR just wraps it in a simple if statement, though I'm not sure that line should be there at all...

ma314smith commented 3 years ago

There was a problem with the build that I believe is fixed now. I'm going to close/reopen this PR to trigger a new build