Errores con XML Signer

[necobm]

Buenas, he visto que en este commit: 4433faf

Han decidido fijar la versión del componente lyquidity/xml-signer a la 1.0.4, cuando realmente dicho componente va por la versión 1.12 actualmente. Ahora mismo con PHP 8.2 está arrojando los siguientes errores dicha librería:

"\nDeprecated: ltrim(): Passing null to parameter #1 ($string) of type string is deprecated in /var/www/html/vendor/lyquidity/xml-signer/src/xml/QualifyingProperties.php on line 61\n\nDeprecated: DOMDocument::createTextNode(): Passing null to parameter #1 ($data) of type string is deprecated in /var/www/html/vendor/lyquidity/xml-signer/src/XMLSecurityDSig.php on line 1135\n"

2023-06-01T15:15:21+00:00 [info] User Deprecated: Method \"lyquidity\\xmldsig\\XAdES::getSignaturePolicyIdentifier()\" might add \"SignaturePolicyIdentifier\" as a native return type declaration in the future. Do the same in child class \"Barnetik\\Tbai\\Xades\\TicketBai\" now to avoid errors or add an explicit @return annotation to suppress this message.\n2023-06-01T15:15:21+00:00 [info] User Deprecated: Method \"lyquidity\\xmldsig\\XAdES::createQualifyingProperties()\" might add \"QualifyingProperties\" as a native return type declaration in the future. Do the same in child class \"Barnetik\\Tbai\\Xades\\TicketBai\" now to avoid errors or add an explicit @return annotation to suppress this message.\n2023-06-01T15:15:21+00:00 [info] User Deprecated: The \"lyquidity\\xmldsig\\xml\\SigningCertificateV2::generateXml()\" method will require a new \"string[] $namespaces\" argument in the next major version of its parent class \"lyquidity\\xmldsig\\xml\\XmlCore\", not defining it is deprecated.\n2023-06-01T15:15:21+00:00 [info] User Deprecated: The \"Barnetik\\Tbai\\Xades\\xmldsig\\xml\\SigningCertificateV2::fromCertificate()\" method will require a new \"Sequence $name\" argument in the next major version of its parent class \"lyquidity\\xmldsig\\xml\\SigningCertificateV2\", not defining it is deprecated.\n2023-06-01T15:15:21+00:00 [info] User Deprecated: Method \"lyquidity\\xmldsig\\xml\\SigningCertificateV2::fromCertificate()\" might add \"SigningCertificate\" as a native return type declaration in the future. Do the same in child class \"Barnetik\\Tbai\\Xades\\xmldsig\\xml\\SigningCertificateV2\" now to avoid errors or add an explicit @return annotation to suppress this message.\n2023-06-01T15:15:21+00:00 [info] User Deprecated: The \"lyquidity\\xmldsig\\xml\\CertV2::generateXml()\" method will require a new \"string[] $namespaces\" argument in the next major version of its parent class \"lyquidity\\xmldsig\\xml\\XmlCore\", not defining it is deprecated.\n2023-06-01T15:15:21+00:00 [info] User Deprecated: The \"lyquidity\\xmldsig\\xml\\DigestAlgAndValue::generateXml()\" method will require a new \"string[] $namespaces\" argument in the next major version of its parent class \"lyquidity\\xmldsig\\xml\\XmlCore\", not defining it is deprecated.\n2023-06-01T15:15:21+00:00 [info] User Deprecated: The \"lyquidity\\xmldsig\\xml\\DigestMethod::generateXml()\" method will require a new \"string[] $namespaces\" argument in the next major version of its parent class \"lyquidity\\xmldsig\\xml\\XmlCore\", not defining it is deprecated.\n2023-06-01T15:15:21+00:00 [info] User Deprecated: The \"lyquidity\\xmldsig\\xml\\QualifyingProperties::generateXml()\" method will require a new \"string[] $namespaces\" argument in the next major version of its parent class \"lyquidity\\xmldsig\\xml\\XmlCore\", not defining it is deprecated.\n2023-06-01T15:15:21+00:00 [info] User Deprecated: The \"lyquidity\\xmldsig\\xml\\SignedProperties::generateXml()\" method will require a new \"string[] $namespaces\" argument in the next major version of its parent class \"lyquidity\\xmldsig\\xml\\XmlCore\", not defining it is deprecated.\n2023-06-01T15:15:21+00:00 [info] User Deprecated: The \"lyquidity\\xmldsig\\xml\\SignedSignatureProperties::generateXml()\" method will require a new \"string[] $namespaces\" argument in the next major version of its parent class \"lyquidity\\xmldsig\\xml\\XmlCore\", not defining it is deprecated.\n2023-06-01T15:15:21+00:00 [info] User Deprecated: The \"lyquidity\\xmldsig\\xml\\SignaturePolicyIdentifier::generateXml()\" method will require a new \"string[] $namespaces\" argument in the next major version of its parent class \"lyquidity\\xmldsig\\xml\\XmlCore\", not defining it is deprecated.\n2023-06-01T15:15:21+00:00 [info] User Deprecated: The \"lyquidity\\xmldsig\\xml\\SignaturePolicyId::generateXml()\" method will require a new \"string[] $namespaces\" argument in the next major version of its parent class \"lyquidity\\xmldsig\\xml\\XmlCore\", not defining it is deprecated.\n2023-06-01T15:15:21+00:00 [info] User Deprecated: The \"lyquidity\\xmldsig\\xml\\ObjectIdentifier::generateXml()\" method will require a new \"string[] $namespaces\" argument in the next major version of its parent class \"lyquidity\\xmldsig\\xml\\XmlCore\", not defining it is deprecated.\n2023-06-01T15:15:21+00:00 [info] User Deprecated: The \"lyquidity\\xmldsig\\xml\\Identifier::generateXml()\" method will require a new \"string[] $namespaces\" argument in the next major version of its parent class \"lyquidity\\xmldsig\\xml\\XmlCore\", not defining it is deprecated.\n2023-06-01T15:15:21+00:00 [info] User Deprecated: The \"lyquidity\\xmldsig\\xml\\SigPolicyHash::generateXml()\" method will require a new \"string[] $namespaces\" argument in the next major version of its parent class \"lyquidity\\xmldsig\\xml\\XmlCore\", not defining it is deprecated.\n2023-06-01T15:15:21+00:00 [info] User Deprecated: The \"lyquidity\\xmldsig\\xml\\PropertiesCollection::generateXml()\" method will require a new \"string[] $namespaces\" argument in the next major version of its parent class \"lyquidity\\xmldsig\\xml\\XmlCore\", not defining it is deprecated.\n2023-06-01T15:15:21+00:00 [info] User Deprecated: The \"lyquidity\\xmldsig\\xml\\SignedDataObjectProperties::generateXml()\" method will require a new \"string[] $namespaces\" argument in the next major version of its parent class \"lyquidity\\xmldsig\\xml\\XmlCore\", not defining it is deprecated.\n2023-06-01T15:15:21+00:00 [info] User Deprecated: The \"lyquidity\\xmldsig\\xml\\DataObjectFormat::generateXml()\" method will require a new \"string[] $namespaces\" argument in the next major version of its parent class \"lyquidity\\xmldsig\\xml\\XmlCore\", not defining it is deprecated.\n2023-06-01T15:15:21+00:00 [info] Deprecated: ltrim(): Passing null to parameter #1 ($string) of type string is deprecated\n2023-06-01T15:15:21+00:00 [info] Deprecated: DOMDocument::createTextNode(): Passing null to parameter #1 ($data) of type string is deprecated\n2023-06-01T15:15:21+00:00 [info] User Deprecated: The \"lyquidity\\xmldsig\\xml\\Transform::generateXml()\" method will require a new \"string[] $namespaces\" argument in the next major version of its parent class \"lyquidity\\xmldsig\\xml\\XmlCore\", not defining it is deprecated.\n

Tenéis planeado actualizar dicha dependencia a una versión mas actual para evitar este tipo de errores o posibles problemas de seguridad, en un futuro inmediato?

[arraintxo]

En su momento se decidió fijar a dicha versión ya que versiones posteriores estaban mostrando algunos problemas de verificación que al menos en nuestro caso no eran "reales".

Volveremos a repasarlo para ver si las últimas versiones de dicha librería son compatibles.

[arraintxo]

He estado haciendo pruebas y parece que las últimas versiones siguen siendo compatibles con Tbai PHP Lib, por lo que seguro que actualizaremos la librería.

Aunque por ahora no tenemos prisa para ello, parece que las útlimas versiones de la librería xml-signer siguen teniendo los problemas deprecated que comentas y esperaremos al menos a que se solucionen para no arriesgarnos a introducir más bugs de los "necesarios" en la libreria.

[necobm]

Gracias @arraintxo pues nosotros estamos usando ahora mismo vuestra librería con Symfony 6 y PHP 8.2 y de momento funciona bien el xml-signer, fuera de todos los mensajes de deprecated que arroja, pero al menos no arroja ningún error que pare el ciclo de ejecución. Estaremos atentos entonces para cuando se decida actualizar la versión. Muchas gracias!

[arraintxo]

Buenas de nuevo @necobm

hemos puesto la version ^1.12 como la mínima requerida actualmente. Tras hacer un par de pruebas me he dado cuenta de que los problemas de sintaxis obsoleta que me estaba mostrando no venían ya de la librería xml-signer, sino de una tercera que se nos había quedado cacheada.

Parece que todo funciona correctamente por lo que ya está subido el nuevo cambio.