search

robrichards / xmlseclibs

A PHP library for XML Security
BSD 3-Clause "New" or "Revised" License
388 stars 181 forks source link

C14N extremely slow on large nodes + potential workaround #220

Open gboor opened 3 years ago

gboor commented 3 years ago

For some project I have to send a SOAP document containing many dozens of thousands of points of data. When trying to sign it using the WSSE library (also by @robrichards), I ran into a very old PHP issue that was never resolved;

https://bugs.php.net/bug.php?id=53655

Basically, sending the document with 43000 data points took well over an hour, just to canonilize. And we're looking at many times that.

The known PHP bug also states that calling C14N on a DomDocument instead of a DomNode is near instant. This caused me to devise the following workaround. In XMLSecurityDSig.php on line 296, replace;

        return $node->C14N($exclusive, $withComments, $arXPath, $prefixList);

with

        $doc = new DOMDocument();
        $newnode = $doc->importNode($node, true);
        $doc->appendChild($newnode);

        return $doc->C14N($exclusive, $withComments, $arXPath, $prefixList);

Now the document canonilization is near instant and I've verified that both methods output the exact same strings.

Since this is a very hacky workaround for a problem that should honestly be solved in PHP itself, I can understand that this should not go into this library as a patch. But if there is any interest, I'm happy to create an PR!