Skip to content

DocFence 0.52.0

Choose a tag to compare

View all tags
@SybilGambleyyu SybilGambleyyu released this 06 Aug 09:05
v0.52.0
b66a397

DocFence 0.52 tightens the OPC same-Signature boundary for SignedInfo references.

  • Each direct SignedInfo Reference must now use an explicit XMLDSIG same-document URI: URI="" or a nonempty local # fragment.
  • Omitted URIs, package-relative references, and absolute references fail the recognized XML-signature shape closed.
  • The parser does not dereference URIs, resolve fragments or XPointers, evaluate transforms, recompute digests, verify XMLDSIG, or make a trust decision.

Validation included the full 69-test suite; positive empty-URI and local-fragment coverage; and a 29-DOCX public USENIX OOXML Signature Security corpus comparison. Only one intentional profile changed: an attacker package carrying eight ODF-style package-file SignedInfo references now raises DocumentFormatError rather than being inventoried as an OPC signature. Wheel and source distribution checks reproduced the behavior outside the source checkout.

Assets 4
Loading