deoxxa / xml-c14n Goto Github PK

Hi, thanks for the code :)

I am trying to use it to canonalize xml in browser and I get:

ReferenceError: setImmediate is not defined
at ExclusiveCanonicalisation.canonicalise (exclusive-canonicalisation.js:23)

Any help is highly appreciated

I tried using this code (along with saml2 and xml-c14n) to process SAML 2.0 assertions from a Shibboeth 2.4 IdP. The verification failed because xml-dsig / xml-c14n ignore the InclusiveNamespaces child element of the canonicalization transform:

<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
  <ec:InclusiveNamespaces
    xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"
    PrefixList="xs"/>
</ds:Transform>

<saml2:Assertion
  xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
  ID="_7cb1dd592c72247faaa5a9e29cb95939"
  IssueInstant="2013-08-31T09:56:50.182Z"
  Version="2.0"
  xmlns:xs="http://www.w3.org/2001/XMLSchema">

<saml2:Assertion
  xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
  xmlns:xs="http://www.w3.org/2001/XMLSchema"
  ID="_7cb1dd592c72247faaa5a9e29cb95939"
  IssueInstant="2013-08-31T09:56:50.182Z"
  Version="2.0">

<saml2:Assertion
  xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
  ID="_7cb1dd592c72247faaa5a9e29cb95939"
  IssueInstant="2013-08-31T09:56:50.182Z"
  Version="2.0">

This issue is basically identical to the issue I just posted here: node-saml/xml-crypto#25

Basically both libraries fail to sort the namespaces correctly. I'm guessing that this library was ported from or started from xml-crypto since this specific code looks similar and has the same problem.

I'm pasting the same issue here, modified for this library:

The namespace compare method '_compareNamespaces ' in exclusive-canonicalization.js is not compliant with the XML Canonicalization specs. The bug in this code is causing the canonical XML to be ordered slightly differently and thus failing signature validation because the digest values are being hashed over malformed canonicalXML.
http://www.w3.org/TR/xml-exc-c14n/ which refers to the rules specified in http://www.ietf.org/rfc/rfc3076.txt .

Specifically, the spec states:
"

An element's namespace nodes are sorted lexicographically by local name (the default namespace node, if one exists, has no local name and is therefore lexicographically least).
An element's attribute nodes are sorted lexicographically with namespace URI as the primary key and local name as the secondary key (an empty namespace URI is lexicographically least). "
For the namespace comparison, instead of sorting by just local name (per spec) the code does this instead:
var attr1 = a.prefix + a.namespaceURI,
attr2 = b.prefix + b.namespaceURI;

if (attr1 === attr2) {
return 0;
}

return attr1.localeCompare(attr2);

For clarification, the 'prefix' here is actually the local name.

But the code is incorrect because the namespaceURI should not be a part of the comparison.

What ends up happening is that if you have something like this:
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"

by doing the namespace comparison of the localName appended with the namespaceURI this string comparison will compare 'samlpurn:oasis:names:tc:SAML:2.0:protocol' to 'samlurnoasis:names:tc:SAML:2.0:assertion'
and the resulting canonicalXML will be incorrectly out of order.

EXPECTED (correct) canonical XML:
<Response xmlns="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Destination....

ACTUAL (incorrect) canonicalXML as a result of the bad namespace comparison:
<Response xmlns="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Destination=....

Verification of the digest value will fail since it is performed on the incorrect canonicalXML.

The namespace comparison should sort based on just the localNames, here as 'saml' to 'samlp'.

The following code snippet shows one way this can be corrected to be spec compliant:
var _compareNamespaces = function _compareNamespaces(a, b) {
var attr1 = a.prefix; // don't compare a.namespaceURI,
var attr2 = b.prefix; // don't compare b.namespaceURI;

if (attr1 === attr2) {
return 0;
}

return attr1.localeCompare(attr2);
};
While you're in there, you might also want to double check the attribute comparison too to make sure that is spec compliant as well (at a glance I'm not sure if the attribute comparison is correct either because it doesn't look like it's using the namespaceURI as a primary key for sorting first , it looks like it may use the localName if present instead of namespaceURI).

I performed browserify exclusive-canonicalisation -o > bundled.js, included script to my page but couldn't instantiate c14n object.

I tried:

var c14n = new CanonicalisationFactory();
// OR
var c14n = CanonicalisationFactory();
// THUS
var c14n = require("xml-c14n")();

https://github.com/node-saml/xml-crypto/blob/master/lib/c14n-canonicalization.js

Canonicalization and Transformation Algorithms

• Canonicalization http://www.w3.org/TR/2001/REC-xml-c14n-20010315
• Canonicalization with comments http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments
• Exclusive Canonicalization http://www.w3.org/2001/10/xml-exc-c14n#
• Exclusive Canonicalization with comments http://www.w3.org/2001/10/xml-exc-c14n#WithComments

Is there any plans to support inclusive canonicalization?

I mean such canonicalization, where
canAlgo!= ...xml-exc-c14n... but canAlgo==...REC-xml-c14n-...

request is kind of overkill.