robrichards / xmlseclibs

A PHP library for XML Security
BSD 3-Clause "New" or "Revised" License
386 stars 180 forks source link

Included InclusiveNamespaces PrefixList for Reference/Signature and Fixed setAttributeNS Problem #218

Open Icegloo24 opened 3 years ago

Icegloo24 commented 3 years ago

The current implementation doesn't support the construction and processing of InclusiveNamespaces for Transforming/Canonicalizing. This pull request includes the possibility to pre-set specific Namespaces for referenced-/signedinfo-elements during the Canonicaliztion-Process and compressed the processing of that info on a private Method.

Another Problem occuring was, that the DOMNode->setAttributeNS() is not registering the Namespace URI properly, so that it doesn't react as expected on the C14N call if it's namespace-prefix is in the prefixList! This Problem is avoidable if the Attribute is first created on the Document and then applied to the Node! That way the namespace gets registered properly.

This might solve #211

Edit: There is a Problem with the correct Canonicalization of the SignedInfo if you try to use Include Namespaces not held by the Template but by the Document to be signed! (I oversaw, that one should already be solved in the sign Method!) Another Problem occurs if you append a new Element with a differing Namespace to an already appended Element! The Namespaces are not properly registered on the Parent Nodes. A possible workaround is to reconstruct the Node-Tree! Otherwise the Canonicalization doesn't seem to always work properly.