Skip to content

Commit b6cc9c0

Browse files
cjbarthcjbarth
authored
Remove default for digest algorithm (#406)
1 parent 5629be4 commit b6cc9c0

File tree

6 files changed

+93
-26
lines changed

6 files changed

+93
-26
lines changed

‎README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,11 +49,11 @@ This will enable HMAC and disable digital signature algorithms. Due to key
4949
confusion issues, it is risky to have both HMAC-based and public key digital
5050
signature algorithms enabled at same time.
5151

52-
by default the following algorithms are used:
52+
By default the following algorithms are used:
5353

5454
_Canonicalization/Transformation Algorithm:_ Exclusive Canonicalization <http://www.w3.org/2001/10/xml-exc-c14n#>
5555

56-
_Hashing/Digest Algorithm:_ SHA1 digest <http://www.w3.org/2000/09/xmldsig#sha1>
56+
_Hashing/Digest Algorithm:_ Must be specified by the user
5757

5858
_Signature Algorithm:_ RSA-SHA1 <http://www.w3.org/2000/09/xmldsig#rsa-sha1>
5959

‎src/signed-xml.ts

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -637,7 +637,7 @@ export class SignedXml {
637637
*
638638
* @param xpath The XPath expression to select the XML nodes to be referenced.
639639
* @param transforms An array of transform algorithms to be applied to the selected nodes. Defaults to ["http://www.w3.org/2001/10/xml-exc-c14n#"].
640-
* @param digestAlgorithm The digest algorithm to use for computing the digest value. Defaults to "http://www.w3.org/2000/09/xmldsig#sha1".
640+
* @param digestAlgorithm The digest algorithm to use for computing the digest value.
641641
* @param uri The URI identifier for the reference. If empty, an empty URI will be used.
642642
* @param digestValue The expected digest value for the reference.
643643
* @param inclusiveNamespacesPrefixList The prefix list for inclusive namespace canonicalization.
@@ -646,12 +646,16 @@ export class SignedXml {
646646
addReference({
647647
xpath,
648648
transforms = ["http://www.w3.org/2001/10/xml-exc-c14n#"],
649-
digestAlgorithm = "http://www.w3.org/2000/09/xmldsig#sha1",
649+
digestAlgorithm,
650650
uri = "",
651651
digestValue,
652652
inclusiveNamespacesPrefixList = [],
653653
isEmptyUri = false,
654654
}: Partial<Reference> & Pick<Reference, "xpath">): void {
655+
if (digestAlgorithm == null) {
656+
throw new Error("digestAlgorithm is required");
657+
}
658+
655659
this.references.push({
656660
xpath,
657661
transforms,

‎test/hmac-tests.spec.ts

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,10 @@ describe("HMAC tests", function () {
4747
sig.enableHMAC();
4848
sig.privateKey = fs.readFileSync("./test/static/hmac.key");
4949
sig.signatureAlgorithm = "http://www.w3.org/2000/09/xmldsig#hmac-sha1";
50-
sig.addReference({ xpath: "//*[local-name(.)='book']" });
50+
sig.addReference({
51+
xpath: "//*[local-name(.)='book']",
52+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
53+
});
5154
sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
5255
sig.computeSignature(xml);
5356

‎test/key-info-tests.spec.ts

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,10 @@ describe("KeyInfo tests", function () {
2828
sig.publicCert = fs.readFileSync("./test/static/hmac.key");
2929
sig.signatureAlgorithm = "http://www.w3.org/2000/09/xmldsig#hmac-sha1";
3030
sig.enableHMAC();
31-
sig.addReference({ xpath: "//*[local-name(.)='book']" });
31+
sig.addReference({
32+
xpath: "//*[local-name(.)='book']",
33+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
34+
});
3235
sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
3336
sig.computeSignature(xml);
3437

‎test/signature-integration-tests.spec.ts

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ describe("Signature integration tests", function () {
1111
sig.privateKey = fs.readFileSync("./test/static/client.pem");
1212

1313
xpath.map(function (n) {
14-
sig.addReference({ xpath: n });
14+
sig.addReference({ xpath: n, digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1" });
1515
});
1616

1717
sig.canonicalizationAlgorithm = canonicalizationAlgorithm;
@@ -171,7 +171,10 @@ describe("Signature integration tests", function () {
171171
const xml = "<library>" + "<book>" + "<name>Harry Potter</name>" + "</book>" + "</library>";
172172

173173
const sig = new SignedXml();
174-
sig.addReference({ xpath: "//*[local-name(.)='book']" });
174+
sig.addReference({
175+
xpath: "//*[local-name(.)='book']",
176+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
177+
});
175178
sig.privateKey = fs.readFileSync("./test/static/client.pem");
176179
sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
177180
sig.computeSignature(xml);

‎test/signature-unit-tests.spec.ts

Lines changed: 72 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,18 @@ describe("Signature unit tests", function () {
2222
const sig = new SignedXml({ idMode: mode });
2323
sig.privateKey = fs.readFileSync("./test/static/client.pem");
2424

25-
sig.addReference({ xpath: "//*[local-name(.)='x']" });
26-
sig.addReference({ xpath: "//*[local-name(.)='y']" });
27-
sig.addReference({ xpath: "//*[local-name(.)='w']" });
25+
sig.addReference({
26+
xpath: "//*[local-name(.)='x']",
27+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
28+
});
29+
sig.addReference({
30+
xpath: "//*[local-name(.)='y']",
31+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
32+
});
33+
sig.addReference({
34+
xpath: "//*[local-name(.)='w']",
35+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
36+
});
2837

2938
sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
3039
sig.computeSignature(xml);
@@ -57,7 +66,10 @@ describe("Signature unit tests", function () {
5766

5867
sig.privateKey = fs.readFileSync("./test/static/client.pem");
5968

60-
sig.addReference({ xpath: "//*[@wsu:Id]" });
69+
sig.addReference({
70+
xpath: "//*[@wsu:Id]",
71+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
72+
});
6173

6274
sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
6375
sig.computeSignature(xml, {
@@ -78,7 +90,10 @@ describe("Signature unit tests", function () {
7890
const xml = `<x xmlns:wsu='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd' ${prefix}Id='_1'></x>`;
7991
const sig = new SignedXml({ idMode });
8092
sig.privateKey = fs.readFileSync("./test/static/client.pem");
81-
sig.addReference({ xpath: "//*[local-name(.)='x']" });
93+
sig.addReference({
94+
xpath: "//*[local-name(.)='x']",
95+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
96+
});
8297
sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
8398
sig.computeSignature(xml);
8499
const signedXml = sig.getOriginalXmlWithIds();
@@ -108,7 +123,10 @@ describe("Signature unit tests", function () {
108123

109124
sig.privateKey = fs.readFileSync("./test/static/client.pem");
110125

111-
sig.addReference({ xpath: "//*[local-name(.)='name']" });
126+
sig.addReference({
127+
xpath: "//*[local-name(.)='name']",
128+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
129+
});
112130

113131
sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
114132
sig.computeSignature(xml, {
@@ -140,7 +158,10 @@ describe("Signature unit tests", function () {
140158
const sig = new SignedXml();
141159

142160
sig.privateKey = fs.readFileSync("./test/static/client.pem");
143-
sig.addReference({ xpath: "//*[local-name(.)='name']" });
161+
sig.addReference({
162+
xpath: "//*[local-name(.)='name']",
163+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
164+
});
144165
sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
145166
sig.computeSignature(xml);
146167

@@ -159,7 +180,10 @@ describe("Signature unit tests", function () {
159180
const sig = new SignedXml();
160181

161182
sig.privateKey = fs.readFileSync("./test/static/client.pem");
162-
sig.addReference({ xpath: "//*[local-name(.)='repository']" });
183+
sig.addReference({
184+
xpath: "//*[local-name(.)='repository']",
185+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
186+
});
163187

164188
sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
165189
sig.computeSignature(xml, {
@@ -186,7 +210,10 @@ describe("Signature unit tests", function () {
186210
const sig = new SignedXml();
187211

188212
sig.privateKey = fs.readFileSync("./test/static/client.pem");
189-
sig.addReference({ xpath: "//*[local-name(.)='repository']" });
213+
sig.addReference({
214+
xpath: "//*[local-name(.)='repository']",
215+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
216+
});
190217

191218
sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
192219
sig.computeSignature(xml, {
@@ -212,7 +239,10 @@ describe("Signature unit tests", function () {
212239
const sig = new SignedXml();
213240

214241
sig.privateKey = fs.readFileSync("./test/static/client.pem");
215-
sig.addReference({ xpath: "//*[local-name(.)='repository']" });
242+
sig.addReference({
243+
xpath: "//*[local-name(.)='repository']",
244+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
245+
});
216246

217247
sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
218248
sig.computeSignature(xml, {
@@ -239,7 +269,10 @@ describe("Signature unit tests", function () {
239269
const sig = new SignedXml();
240270

241271
sig.privateKey = fs.readFileSync("./test/static/client.pem");
242-
sig.addReference({ xpath: "//*[local-name(.)='repository']" });
272+
sig.addReference({
273+
xpath: "//*[local-name(.)='repository']",
274+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
275+
});
243276

244277
sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
245278
sig.computeSignature(xml, {
@@ -590,9 +623,18 @@ describe("Signature unit tests", function () {
590623
const sig = new SignedXml();
591624
sig.privateKey = fs.readFileSync("./test/static/client.pem");
592625

593-
sig.addReference({ xpath: "//*[local-name(.)='x']" });
594-
sig.addReference({ xpath: "//*[local-name(.)='y']" });
595-
sig.addReference({ xpath: "//*[local-name(.)='w']" });
626+
sig.addReference({
627+
xpath: "//*[local-name(.)='x']",
628+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
629+
});
630+
sig.addReference({
631+
xpath: "//*[local-name(.)='y']",
632+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
633+
});
634+
sig.addReference({
635+
xpath: "//*[local-name(.)='w']",
636+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
637+
});
596638

597639
sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
598640
sig.computeSignature(xml);
@@ -658,9 +700,18 @@ describe("Signature unit tests", function () {
658700
sig.signatureAlgorithm = "http://dummySignatureAlgorithmAsync";
659701
sig.privateKey = fs.readFileSync("./test/static/client.pem");
660702

661-
sig.addReference({ xpath: "//*[local-name(.)='x']" });
662-
sig.addReference({ xpath: "//*[local-name(.)='y']" });
663-
sig.addReference({ xpath: "//*[local-name(.)='w']" });
703+
sig.addReference({
704+
xpath: "//*[local-name(.)='x']",
705+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
706+
});
707+
sig.addReference({
708+
xpath: "//*[local-name(.)='y']",
709+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
710+
});
711+
sig.addReference({
712+
xpath: "//*[local-name(.)='w']",
713+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
714+
});
664715

665716
sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
666717
sig.computeSignature(xml, function () {
@@ -918,7 +969,10 @@ describe("Signature unit tests", function () {
918969
const sig = new SignedXml();
919970

920971
sig.privateKey = fs.readFileSync("./test/static/client.pem");
921-
sig.addReference({ xpath: "//*[local-name(.)='repository']" });
972+
sig.addReference({
973+
xpath: "//*[local-name(.)='repository']",
974+
digestAlgorithm: "http://www.w3.org/2000/09/xmldsig#sha1",
975+
});
922976

923977
try {
924978
sig.computeSignature(xml, {

0 commit comments

Comments
 (0)