Remove signature nodes appropriately #46
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…le signatures in XML. Removal is also done so that any text after the signature is preserved
…gger the appropriate transformation paths
| @@ -588,11 +612,14 @@ def verify(self, require_x509=True, x509_cert=None, ca_pem_file=None, ca_path=No | |||
| root = fromstring(self.data, parser=parser) | |||
| else: | |||
| root = self.data | |||
| c14n_root = fromstring(etree.tostring(root)) | |||
There was a problem hiding this comment.
I don't truly understand why this is necessary. Can you explain?
There was a problem hiding this comment.
Since we may need to apply transformation modifying the XML tree during the canonicalization process we need to make a copy of it to prevent modifying the original tree.
Originally I used copy.deepcopy but with lxml it failed at preserving the namespaces on the root node which broke some cases, thus I instead copy the tree in this way.
|
Thanks. This is outstanding work. I'm merging, but I'd appreciate it if you could answer the question I left inline. |
|
@kislyuk Answered, it's mostly a hack around copy.deepcopy not preserving unused namespaces on the root node. |
|
Released in v0.6.0. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This solves the issue with double signatures in XML. Removal is also done so that any text after the signature is preserved.
I found this issue when trying to validate SAML 2.0 responses with a signature on both the assertion and the node signed with the library.
This should at least solve #40 but it may solve others like #44