Merge pull request #1123 from Sustainsys/empty_ref_exception

More informative exception for empty signature reference URI
Sustainsys · Oct 31, 2019 · c56c23b · c56c23b
2 parents 353c015 + 9911947
commit c56c23b
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 0 deletions.
diff --git a/Sustainsys.Saml2/XmlHelpers.cs b/Sustainsys.Saml2/XmlHelpers.cs
@@ -451,6 +451,10 @@ private static void FixSignatureIndex(SignedXml signedXml, XmlElement signatureE
             }
 
             var reference = (Reference)signedXml.SignedInfo.References[0];
+            if ( string.IsNullOrWhiteSpace( reference.Uri ) )
+            {
+                throw new InvalidSignatureException( "Empty reference for Xml signature is not allowed." );
+            }
             var id = reference.Uri.Substring(1);
 
 			var idElement = signedXml.GetIdElement(xmlElement.OwnerDocument, id);

diff --git a/Tests/Tests.Shared/XmlHelpersTests.cs b/Tests/Tests.Shared/XmlHelpersTests.cs
@@ -238,6 +238,31 @@ public void XmlHelpers_IsSignedBy_ThrowsOnMissingReferenceInSignature()
                 .And.Message.Should().Be("No reference found in Xml signature, it doesn't validate the Xml data.");
         }
 
+        [TestMethod]
+        public void XmlHelpers_IsSignedBy_ThrowsOnEmptyReferencesInSignature()
+        {
+            var xml = "<xml ID=\"myxml\" />";
+
+            var xmlDoc = XmlHelpers.XmlDocumentFromString( xml );
+
+            var signedXml = new SignedXml( xmlDoc );
+            signedXml.SigningKey = SignedXmlHelper.TestCert.PrivateKey;
+            signedXml.SignedInfo.CanonicalizationMethod = SignedXml.XmlDsigExcC14NTransformUrl;
+
+            var ref1 = new Reference { Uri = "" };
+            ref1.AddTransform( new XmlDsigEnvelopedSignatureTransform() );
+            ref1.AddTransform( new XmlDsigExcC14NTransform() );
+            signedXml.AddReference( ref1 );
+
+            signedXml.ComputeSignature();
+            xmlDoc.DocumentElement.AppendChild( xmlDoc.ImportNode( signedXml.GetXml(), true ) );
+
+            xmlDoc.DocumentElement.Invoking(
+                x => x.IsSignedBy( SignedXmlHelper.TestCert ) )
+                .Should().Throw<InvalidSignatureException>()
+                .And.Message.Should().Be( "Empty reference for Xml signature is not allowed." );
+        }
+
         [TestMethod]
         public void XmlHelpers_IsSignedBy_ThrowsOnDualReferencesInSignature()
         {