Skip to content

Commit bb297b1

Browse files
kislyukkislyuk
committed
Add InclusiveNamespaces PrefixList support for SignedInfo
Fixes #145
1 parent f8d1511 commit bb297b1

File tree

4 files changed

+66
-1
lines changed

4 files changed

+66
-1
lines changed

‎signxml/__init__.py‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -724,13 +724,16 @@ def verify(self, data, require_x509=True, x509_cert=None, cert_subject_name=None
724724
signed_info = self._find(signature, "SignedInfo")
725725
c14n_method = self._find(signed_info, "CanonicalizationMethod")
726726
c14n_algorithm = c14n_method.get("Algorithm")
727+
inclusive_ns_prefixes = self._get_inclusive_ns_prefixes(c14n_method)
727728
signature_method = self._find(signed_info, "SignatureMethod")
728729
signature_value = self._find(signature, "SignatureValue")
729730
signature_alg = signature_method.get("Algorithm")
730731
raw_signature = b64decode(signature_value.text)
731732
x509_data = signature.find("ds:KeyInfo/ds:X509Data", namespaces=namespaces)
732733
key_value = signature.find("ds:KeyInfo/ds:KeyValue", namespaces=namespaces)
733-
signed_info_c14n = self._c14n(signed_info, algorithm=c14n_algorithm)
734+
signed_info_c14n = self._c14n(signed_info,
735+
algorithm=c14n_algorithm,
736+
inclusive_ns_prefixes=inclusive_ns_prefixes)
734737

735738
# TODO: if both X509Data and KeyValue is present, match one against the other and raise an error on mismatch
736739
if x509_data is not None or self.require_x509:

‎test/interop/soap/ca.pem‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIFyjCCA7KgAwIBAgIBATANBgkqhkiG9w0BAQ0FADB9MQswCQYDVQQGEwJDWjEm
3+
MCQGA1UEAwwdVEVTVCBlLUthc2EgU0sgQ0EvUlNBIDAxLzIwMTkxLTArBgNVBAoM
4+
JFBydm7DrSBjZXJ0aWZpa2HEjW7DrSBhdXRvcml0YSwgYS5zLjEXMBUGA1UEYQwO
5+
TlRSQ1otMjY0MzkzOTUwHhcNMTkwMTI4MDk0NTQ3WhcNMjkwMTI1MDk0NTQ3WjB9
6+
MQswCQYDVQQGEwJDWjEmMCQGA1UEAwwdVEVTVCBlLUthc2EgU0sgQ0EvUlNBIDAx
7+
LzIwMTkxLTArBgNVBAoMJFBydm7DrSBjZXJ0aWZpa2HEjW7DrSBhdXRvcml0YSwg
8+
YS5zLjEXMBUGA1UEYQwOTlRSQ1otMjY0MzkzOTUwggIiMA0GCSqGSIb3DQEBAQUA
9+
A4ICDwAwggIKAoICAQCysGlrnEEVcs83zpczNL9VQacpNeUyIovsMXV7HSqVmdiF
10+
mgevovE5BpLfW/Ocje4IDKMZtK0gdE6tGAxIF1vXbzXChyZ90YwZVob21uvRFDw/
11+
ZmxgLTdx9iGytp2OaHU50Yhmux1y5KahLQI4MbzV1PqXTnZ/iGjEKyZbG5MVZ9To
12+
c5g99FThv4VKYglQziBM55QsV0iAjPUGJ9W6qIb0EdpBNApqiXOUfuWCWa8qI8W7
13+
K6ogibcBGHEOtX/DaVcJXLta1p/2VWrJf17oFNAODbt7xPfLW9FG5OrI6pMZshor
14+
p6s6cYyyXTLYU1RlG6jnCk5AbG8Id5ptF0aZF1NO/MFdJxvAl+iF7lJhiOCKIaZa
15+
olIjqytKyD1+OqZUQkIVCKGO9fVrpqKZOE5+pMAZUeiGhmABlibRIQpVIW7yMn/X
16+
Y4ISfY3a1RvQLF8Co36hq4ijEyXe0zHEAmhTa/+txjoYt4KwvrQxZP8o1euHLcca
17+
E/05g1rKTnJ8YDzhzRC/2p4JKACVWpPLxCr2GWZTe+tUlX1L09IEPeyQCCIJSEV+
18+
JPkacygkfYiG1i/0NpmPQ3WxEEYlhVJFrLB7Gx+eU8cwAyUd3XUYf+eZGpF4kORV
19+
EX3zhcoltD1en0IDf+567RWUtBQLzEVvRNWHfxd3cPkRODyaFT4po8TpP4O5VQID
20+
AQABo1UwUzARBgNVHSAECjAIMAYGBFUdIAAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV
21+
HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFHyYjmKfmPEXskPt8Y85+go4LI4CMA0GCSqG
22+
SIb3DQEBDQUAA4ICAQBRupOif1UXaJxnVB7g4g3Ue4csl4tcjoJsla5El2gGDZ5n
23+
SzhOgaV/xlFtKgUldxdGFVHro5pKUlUIb8nLIQZJPUQPu9U3qOkdizRl1I3OttoU
24+
6B1IP3BvbcXO5EbfAoOoaoGdrrOXZkHLA/Yfncj8PH/d4wmoSvkTl2yN2t25Ljjl
25+
gfon0VFBUNQvA2Ma8+RwS+Tf5n1Jh2SonXEPhfzO/LpIkkv9DlRX+ks1M6SmsK4Q
26+
9LKRY5gvER/nRxR0bMt/EvEhYfaSdc16a4TNKJOQTfMKdtXRJAQVBAs1t9t2CWp9
27+
n5HHK29bSSr4QgGOH9u2b5FsjwSGoUUT0bgnyv2d+tiSWc+b7rQEiBYsNFUybzHb
28+
zcZl9GT4P4DgY4qI14CHcoCR1m/5cTkX17PEPFmAkWErGm7MV/eE4JYZAMyL3AtK
29+
VFAmiAshaXzkQ6xjGMf5PTy2YckFmDQDCqmJdoMzJzyaDbTqtzGwjurkafBGFsp2
30+
tV23a/N5kHgmifQrsVnk3osQjeSkzhvYj80+7Ji+UmT21Z5Mz+Y147XA/0Z3dvdN
31+
PWnTQ4xNo+g4L4WPaN4hky1ezOQnM8c5grVZ70T/E86nyII4Gt/YYKoUcHIkfw7V
32+
HSU6cWNgsRZmJ6QJ4dacrnon2oYbhvvO0oHJS7EPZj1DPwf3RrvfnTzAmGbtQw==
33+
-----END CERTIFICATE-----

‎test/interop/soap/request.xml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<soapenv:Envelope xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope">
2+
<soapenv:Header><wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><ds:Signature Id="SIG-D4754E6D65BB527E86154893382399365" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces PrefixList="soapenv" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:CanonicalizationMethod><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><ds:Reference URI="#id-D4754E6D65BB527E86154893382397164"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces PrefixList="" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>F1LG1c5oMWZT04jkYzq0RU68id7wukAVwR39nFEpDdI=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>f2CupENRZR5Dte9rx6AC1o8tQmXMHEX/mnFnA2r7y7z8tZBBdb+wkPgXBHu3D/5kV8p61luPlV3S
3+
8iwWHw20tAhS2RfSkvNfTLUxl2yORnzrxZWUYriNUVhGKBfAWc7ztiBG2cWqslGk2WCy8EL1DQT6
4+
hCej2bt8lXBtHB5Gjr5m3WoMZo8ycNm6ALUgZy1WtXG9FBDl293FN15ewiTAJ6AGbXBtg9W6dLfF
5+
jzaocjSjCT4H8DGElfggt5GDhQ0nohHJJhx7abyh6mSNpeJnO/bxdXgAfZaWNWxphsE4NKZh/HCb
6+
nr7woCghTlQYOfmAAgq+Il48xtpP0/lVeiD6jw==</ds:SignatureValue><ds:KeyInfo Id="KI-D4754E6D65BB527E86154893382397162"><wsse:SecurityTokenReference wsu:Id="STR-D4754E6D65BB527E86154893382397163"><wsse:Reference URI="#X509-D4754E6D65BB527E86154893382397061" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/></wsse:SecurityTokenReference><ds:X509Data><ds:X509Certificate>MIIFrjCCA5agAwIBAgICKwowDQYJKoZIhvcNAQELBQAwfTELMAkGA1UEBhMCQ1oxJjAkBgNVBAMMHVRFU1QgZS1LYXNhIFNLIENBL1JTQSAwMS8yMDE5MS0wKwYDVQQKDCRQcnZuw60gY2VydGlmaWthxI1uw60gYXV0b3JpdGEsIGEucy4xFzAVBgNVBGEMDk5UUkNaLTI2NDM5Mzk1MB4XDTE5MDEzMDE1MDcwMVoXDTIxMDEyOTE1MDcwMVowfDE2MDQGA1UEAwwtVkFUU0stMTIzNDU2Nzg5MCBQT0tMQUROSUNBIDg4ODEyMzQ1Njc4OTAwMDAxMRowGAYDVQQLDBE4ODgxMjM0NTY3ODkwMDAwMTEZMBcGA1UEYQwQVkFUU0stMTIzNDU2Nzg5MDELMAkGA1UEBhMCU0swggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC0zX5lI6Lsb77ynRSJ4clo7S5UTzMtImPkN0YPn+J5a2LY03N3NHfyloH8oqggYYAJ5XM8IE6LMqk+aaibWc4iNF5Z+KkK71se5dBlFsjxMkpyihFbsB4JC0Unuw0gG4GEGsm5HJyAkJxowIYP/RB0mx1r4QQKtkvzfTlKvWEVCKbQ5dp1ieuBRzug95ObURWRwcuBQRiolYU6k6HyqV0XmOcfCRi1bGalLk/cAs10xK5AZMsKu8rqUYZbc1nPWT9PAhQBURHVF1xIXBGzytvBUEXgQO7s0kssvpPLoMuw8JOJAy+AefyDiJq678do9RB27SCfGgyOGDUTiWNxMu0vAgMBAAGjggE3MIIBMzAOBgNVHQ8BAf8EBAMCBeAwGgYDVR0gBBMwETAPBg0rBgEEAYG4SAoDbgEAMDUGA1UdHwQuMCwwKqAooCaGJGh0dHA6Ly90ZXN0cy5pY2EuY3ovdGVrYXNhMTlfcnNhLmNybDBuBggrBgEFBQcBAQRiMGAwMAYIKwYBBQUHMAKGJGh0dHA6Ly90ZXN0cy5pY2EuY3ovdGVrYXNhMTlfcnNhLmNlcjAsBggrBgEFBQcwAYYgaHR0cDovL3RvY3NwLmljYS5jei90ZWthc2ExOV9yc2EwCQYDVR0TBAIwADAdBgNVHQ4EFgQUpYS96NutKhpSkdAfFI4gOeKnXakwHwYDVR0jBBgwFoAUfJiOYp+Y8ReyQ+3xjzn6CjgsjgIwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggIBAGXHmNRUchdEcMKEm4W1O7cie+yQwk/kdix4l5Ry+4Rtd4mhkFfz+kM1AIC1o+bAKqVwg4GC02JJleyDSm+rANeWio+9ndaRk6Wx80IGeTAkKYnzkpuuTUrQvL8jGdoa7HgFHYN6xHMcdbR1PtmTiMYiyTTnyRvcVnwDqxq+vcqJFQWV3qqI6pXjrnZWunyz56GgvOH+CPskX6M6VhWRjBMIsfeZUdmTMH68EZShJP7BSme3IhjEFMHHWBmOOnXWWfjDElomMUj0ddPeJgx6CnHKNLVnlHeGvAloVrF8bOnYttHbrd4aOICa5IbcDkGb4a0BKf5w8S2hdWDwFh/IGPYrZvhsyMWxYZEWwnGc5YwFTQ2k+l+QO0UKZUg2cT6NtviPQ74oWZ5Z7H4eKFz2DCXZnTm3LNx/suI+4YSYNSmwS38ioTfWhHoSOBolVsS/UlZCzfWyqvds/ZUR8cdp3MjycE76Fjxuve3zU8dOdsoE5bCRuhMTsZiUKl3HIVkw5VgOhs//0fcb6ckEt4TLt/UIIo2Hg6yXGIyCi4paz8X9QLNioQNoJqOgDPZmahhZm4D5wJ9SYHmqNF51qHdRfIZcnBCtzZA4cAwNiy5jBkTTmIJwn31rzbRHsqN5cJWwhQT9KYQtu4fc4vPgEkhWbKTwgaes832lSIRYcfydAcPW</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature></wsse:Security></soapenv:Header>
7+
<soapenv:Body wsu:Id="id-D4754E6D65BB527E86154893382397164" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
8+
<ekasa:RegisterLocationRequest xmlns:ekasa="http://financnasprava.sk/ekasa/schema/v2">
9+
<ekasa:Header RequestDate="2019-01-31T12:01:14+01:00" SendingCount="2" SwId="b61f1694810c3b35c6cf475785a8739110c3b35c" Uuid="b05226a4-88b2-46e4-af45-0f28dcf3668f"/>
10+
<ekasa:LocationData CashRegisterCode="88812345678900001" CreateDate="2019-01-31T12:01:14+01:00" Dic="1234567890">
11+
<ekasa:Location>
12+
<ekasa:Other>Taxi ABC SPZ=BA 123 AA</ekasa:Other>
13+
</ekasa:Location>
14+
</ekasa:LocationData>
15+
</ekasa:RegisterLocationRequest>
16+
</soapenv:Body>
17+
</soapenv:Envelope>

‎test/test.py‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -412,5 +412,17 @@ def test_xml_attacks(self):
412412
with self.assertRaises((InvalidInput, etree.XMLSyntaxError)):
413413
XMLVerifier().verify(fh.read())
414414

415+
def test_soap_request_with_inclusive_namespaces(self):
416+
with open(os.path.join(interop_dir, "soap", "request.xml")) as req_fh:
417+
with self.assertRaises(etree.DocumentInvalid):
418+
XMLVerifier().verify(req_fh.read(),
419+
ca_pem_file=os.path.join(interop_dir, "soap", "ca.pem"),
420+
expect_references=False)
421+
req_fh.seek(0)
422+
XMLVerifier().verify(req_fh.read(),
423+
ca_pem_file=os.path.join(interop_dir, "soap", "ca.pem"),
424+
expect_references=False,
425+
validate_schema=False)
426+
415427
if __name__ == '__main__':
416428
unittest.main()

0 commit comments

Comments
 (0)