Skip to content

build(deps): bump signxml from 2.6.0 to 2.8.0 #128

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

build(deps): bump signxml from 2.6.0 to 2.8.0 #128

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion cl_sii/libs/xml_utils.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -431,8 +431,24 @@ def verify_xml_signature(
try:
# note: by passing 'x509_cert' we override any X.509 certificate information supplied
# by the signature itself.

# note: when an X509Data element is present in the signature and used for verification, but
# a KeyValue element is also present, there is an ambiguity and a security hazard because
# the public key used to sign the document is already encoded in the certificate (which is
# in X509Data), so the verifier must either ignore KeyValue or ensure that it matches what
# is in the certificate. SignXML does not perform that validation and throws an
# 'InvalidInput' error instead.
#
# SII's schema for XML signatures requires both elements to be present, which forces us to
# enable 'ignore_ambiguous_key_info' to bypass the error and validate the signature using
# X509Data only.
#
# Source:
# https://github.com/XML-Security/signxml/commit/ef15da8dbb904f1dedfdd210ae3e0df5da535612
result: signxml.VerifyResult = xml_verifier.verify(
data=tmp_bytes, require_x509=True, x509_cert=trusted_x509_cert_open_ssl)
data=tmp_bytes, require_x509=True, x509_cert=trusted_x509_cert_open_ssl,
ignore_ambiguous_key_info=True,
)

except signxml.exceptions.InvalidDigest as exc:
# warning: catch before 'InvalidSignature' (it is the parent of 'InvalidDigest').
Expand Down
5 changes: 1 addition & 4 deletions requirements/base.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ lxml==4.5.0
marshmallow==2.19.5
pyOpenSSL==18.0.0
pytz==2019.3
signxml==2.6.0
signxml==2.8.0

# Packages dependencies:
# - cryptography:
Expand All @@ -24,16 +24,13 @@ signxml==2.6.0
# - setuptools
# - six
# - signxml:
# - asn1crypto
# - certifi
# - cryptography
# - defusedxml
# - eight
# - future
# - lxml
# - pyOpenSSL
# - six
asn1crypto==1.3.0
attrs==19.3.0
certifi==2020.4.5.1
cffi==1.14.0
Expand Down
6 changes: 3 additions & 3 deletions setup.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,10 +27,10 @@ def get_version(*file_paths: Sequence[str]) -> str:
'jsonschema>=3.1.1',
'lxml>=4.5.0,<5',
'marshmallow>=2.19.2,<3',
# TODO: remove upper-bound after a new release of 'signxml' drops the requirement 'pyOpenSSL<19'
'pyOpenSSL>=18.0.0,<19',
# TODO: remove upper-bound after a new release of 'signxml' drops the requirement 'pyOpenSSL<20'
'pyOpenSSL>=18.0.0,<20',
'pytz>=2019.3',
'signxml>=2.6.0',
'signxml>=2.8.0',
]

extras_requirements = {
Expand Down