From 0956d0686f780872d396e8e605402d38705a620d Mon Sep 17 00:00:00 2001 From: Chris Barth Date: Mon, 14 Sep 2026 15:22:34 -0500 Subject: [PATCH] fix: report a validated node or reference only after the signature verifies getValidatedNode() returned null only when a reference's digest failed, and validateElementAgainstReferences() compared digests against the unverified SignedInfo. With a forged SignatureValue, checkSignature() threw and getSignedReferences() stayed empty, yet getValidatedNode() returned the referenced node and validateElementAgainstReferences() returned the reference, before or after checkSignature(). Both now consider a reference only after checkSignature() has verified the SignatureValue, which is when signedReference is set. The getValidatedNode() warning now points only at getSignedReferences(). Co-Authored-By: Claude Opus 5 --- src/signed-xml.ts | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/signed-xml.ts b/src/signed-xml.ts index 9ab66be0..0dd5f72a 100644 --- a/src/signed-xml.ts +++ b/src/signed-xml.ts @@ -503,6 +503,9 @@ export class SignedXml { /* eslint-disable-next-line deprecation/deprecation */ for (const ref of this.getReferences()) { + if (ref.signedReference === undefined) { + continue; + } const uri = ref.uri?.[0] === "#" ? ref.uri.substring(1) : ref.uri; for (const attr of this.idAttributes) { @@ -558,12 +561,12 @@ export class SignedXml { ref.getValidatedNode = deprecate((xpathSelector?: string) => { xpathSelector = xpathSelector || ref.xpath; - if (typeof xpathSelector !== "string" || ref.validationError != null) { + if (typeof xpathSelector !== "string" || ref.signedReference === undefined) { return null; } const selectedValue = xpath.select1(xpathSelector, doc); return isDomNode.isNodeLike(selectedValue) ? selectedValue : null; - }, "`ref.getValidatedNode()` is deprecated and insecure. Use `ref.signedReference` or `this.getSignedReferences()` instead."); + }, "`ref.getValidatedNode()` is deprecated and insecure. Use `getSignedReferences()` instead."); if (!isDomNode.isNodeLike(elem)) { const validationError = new Error(