frazeradam
commented
1 year ago I took a crack at this and made some progress, but I've got a few question on how the internals are organized that I'm blocked on.
Inside signatureData.getReferencedXML I have been able to propagate the namespace up, but it appears that making the changes there the code to normalize the order of the attributes must have already run so simply appending the propagated namespaces gets me close, but not quite there. Intentionally putting the namespace first does it, but if there are multiple namespaces that need ordering it wouldn't work, so I do need to make sure that things go through the attribute ordering code.
If you do have an idea on that last step, I'm happy to submit my changes as a PR. From what I can tell renderAttributes seems to be involved in all of this but doesn't seem to fit correctly with what I'm doing.
Mostly working code in signedxml.go for feedback as well if I'm causing any unintentional side effects that would break other systems:
func (s *signatureData) getReferencedXML(reference *etree.Element, inputDoc *etree.Document) (outputDoc *etree.Document, err error) {
uri := reference.SelectAttrValue("URI", "")
uri = strings.Replace(uri, "#", "", 1)
// populate doc with the referenced xml from the Reference URI
if uri == "" {
outputDoc = inputDoc
} else {
refIDAttribute := "ID"
if s.refIDAttribute != "" {
refIDAttribute = s.refIDAttribute
}
path := fmt.Sprintf(".//[@%s='%s']", refIDAttribute, uri)
e := inputDoc.FindElement(path)
if e == nil {
// SAML v1.1 Assertions use AssertionID
path := fmt.Sprintf(".//[@AssertionID='%s']", uri)
e = inputDoc.FindElement(path)
}
if e != nil {
// Attempt namespace propagation
if err := s.propagateNamespace(e, e, inputDoc); err != nil {
return nil, err
}
// Turn the node into a full document we can work on
outputDoc = etree.NewDocument()
outputDoc.SetRoot(e.Copy())
}
}
if outputDoc == nil {
return nil, errors.New("signedxml: unable to find refereced xml")
}
return outputDoc, nil
}
func (s *signatureData) propagateNamespace(e *etree.Element, base *etree.Element, inputDoc *etree.Document) error {
// We begin by trying to resolve any references for the top level element, then we can recuse trying to resolve things
attr, err := findNamespace(e, base, inputDoc)
if err != nil {
return err
}
if attr != nil {
// Apply it to our current element
e.Attr = append(e.Attr, *attr)
// We need to sort such that namespaces come first and I have no idea how to make that happen here
}
for _, elem := range e.ChildElements() {
if err := s.propagateNamespace(elem, base, inputDoc); err != nil {
return err
}
}
return nil
}
// findNamespace looks to find the namespace for e, returning it if and only if it's inside inputDoc but outside base.
// If there is a reference to the namespace and it can't be found an error will be returned.
func findNamespace(e *etree.Element, base *etree.Element, inputDoc *etree.Document) (*etree.Attr, error) {
xlmns := "xmlns:" + e.Space
// If there isn't a namespace, we can skip this whole function
if e.Space == "" {
return nil, nil
}
// If the namespace's reference is in the element itself, we have nothing to do
if e.SelectAttr(xlmns) != nil {
return nil, nil
}
// Start searching up the chain for a match
current := e
for {
current = current.Parent()
if current == nil {
return nil, fmt.Errorf("couldn't resolve namespace reference of %s:%s", e.Space, e.Tag)
}
if attr := current.SelectAttr(xlmns); attr != nil {
// We found it, last thing to do is check and see if it's inside or outside our input doc
if containsElement(base, current) {
return nil, nil
}
return attr, nil
}
}
}
// containsElement returns true if e is base or is base has e as any of its child nodes recursively
func containsElement(base *etree.Element, e *etree.Element) bool {
if base == e {
return true
}
for _, child := range base.ChildElements() {
if containsElement(child, e) {
return true
}
}
return false
}
adamdecaf
I've been working on getting some code moved off of PHP and into Go, and in testing found different behavior from a known working PHP system. It appears that namespaces aren't getting propagated when taking the subset that is getting signed, as in the example in section 3.7 here https://www.w3.org/TR/2001/REC-xml-c14n-20010315
In our case the (extremely abbreviated) XML is:
where in the dump I've extracted from inside the PHP library I'm using the body gets converted to
and then generates the correct DigestValue.
I believe the canonicalization algorithm requires that when taking a subset, it needs to look up the chain for any namespace declarations, and move them to the highest level tag(s) that first reference that namespace (or something like that, the c14n specs are painful).