Empty reference URI for enveloped signature

[alphanso]

I was using this library for signing xml using the following: -

• CanonicalizationMethod : http://www.w3.org/TR/2001/REC-xml-c14n-20010315
• SignatureMethod : http://www.w3.org/2000/09/xmldsig#rsa-sha1
• Transform : http://www.w3.org/2000/09/xmldsig#enveloped-signature

Signed XML is verified by vendor and they need empty URI or signature verification fails.

https://www.w3.org/TR/xmldsig-core/#sec-URI says

If the URI attribute is omitted altogether, the receiving application is expected to know the identity of the object.

I believe we should default to empty URI in case of enveloped signature and should make it possible to omit only by choice.

[rmhrisk]

I am OK with us taking that as a change, feel free to submit a PR, absent that we can look at this when we get time.

[gine]

@rmhrisk i think that there is bug on this.

If you set uri : "" in the ReferenceOptions, the code produced doesn't have the empty uri attribute. I'm trying to find where i can fix it, but i don't find the where. Can you point me.

[microshine]

@gine xmldsig has default value for Reference.Uri
https://github.com/PeculiarVentures/xmldsigjs/blob/master/src/xml/reference.ts#L45

URI is optional value in xmldsig XSD
https://github.com/PeculiarVentures/xmldsigjs/blob/master/src/xml/reference.ts#L18

You can recompile xmdsig.js file and remove defaultValue from XmlAttribute decorator
I think it'll fix your problem

[rmhrisk]

@microshine it seems intuitive that setting uri : "" in the ReferenceOptions would produce a value of "" and nul an empty one? Is that right?

[microshine]

@rmhrisk I think so. I'll update library

[microshine]

@gine I updated xmldsig. I can't publish it, cause it have some security/snyc issues. I'll fix it later. But you can try new version

npm i https://github.com/PeculiarVentures/xmldsigjs#update

If uri isn't in option, then <Reference>
If uri is "", then <Reference Uri="">
If uri is "some-id", then <Reference Uri="some-id">

[gine]

I made a stupid fix. I presume that your fix is better. Tomorrow i'll try it

[Ameb]

Hello. I wanted to try the new version but i won't install properly. dist folder isn't generated.

Could you try it, @gine ?

[microshine]

@Ameb I added prepare script to package.json. It must fix error. Can you try it again?

[Ameb]

Thank you! Nice to have <ds:Reference URI="">

[microshine]

@Ameb I'll fix security/snyc issue and publish new version. Thank you for test