diff --git a/test/document-tests.spec.ts b/test/document-tests.spec.ts index b831199..2d0c0cf 100644 --- a/test/document-tests.spec.ts +++ b/test/document-tests.spec.ts @@ -132,3 +132,22 @@ describe("Validated node references tests", function () { expect(sig.getSignedReferences().length).to.equal(0); }); }); + +describe("Signed reference tests", function () { + it("should read signed data from the signed references", function () { + const xml = fs.readFileSync("./test/static/valid_saml.xml", "utf-8"); + const doc = new xmldom.DOMParser().parseFromString(xml); + const sig = new SignedXml(); + sig.getCertFromKeyInfo = SignedXml.getCertFromKeyInfo; + sig.loadSignature(sig.findSignatures(doc)[0]); + expect(sig.checkSignature(xml)).to.be.true; + + const signedDoc = new xmldom.DOMParser().parseFromString(sig.getSignedReferences()[0]); + const mail = xpath.select1( + "//*[local-name()='Attribute' and @Name='mail']/*[local-name()='AttributeValue']/text()", + signedDoc, + ); + isDomNode.assertIsNodeLike(mail); + expect(mail.nodeValue).to.equal("henri.bergius@nemein.com"); + }); +}); diff --git a/test/signature-integration-tests.spec.ts b/test/signature-integration-tests.spec.ts index 6025843..2fd41c5 100644 --- a/test/signature-integration-tests.spec.ts +++ b/test/signature-integration-tests.spec.ts @@ -783,8 +783,17 @@ describe("Signature integration tests", function () { reference: "/root[not(@Id)]", detached: false, }, - { name: "creates a verifiable detached signature", reference: "/*", detached: true }, - ]) { + { + name: "creates a verifiable detached signature", + reference: "/*", + detached: "generated IDs", + }, + { + name: "creates a verifiable detached signature over elements that carry their IDs", + reference: "/*", + detached: "input IDs", + }, + ] as const) { it(name, async function () { const signer = new SignedXml({ privateKey, @@ -797,7 +806,8 @@ describe("Signature integration tests", function () { digestAlgorithm: "http://www.w3.org/2001/04/xmlenc#sha256", }); - const xml = "trusted"; + const xml = + detached === "input IDs" ? 'trusted' : "trusted"; if (useCallback) { await new Promise((resolve, reject) => { signer.computeSignature(xml, (err) => (err ? reject(err) : resolve())); @@ -806,10 +816,12 @@ describe("Signature integration tests", function () { signer.computeSignature(xml); } - const signedXml = detached - ? // eslint-disable-next-line deprecation/deprecation - signer.getOriginalXmlWithIds() - : signer.getSignedXml(); + const signedXml = !detached + ? signer.getSignedXml() + : detached === "input IDs" + ? xml + : // eslint-disable-next-line deprecation/deprecation + signer.getOriginalXmlWithIds(); const verifier = new SignedXml({ publicCert }); verifier.loadSignature(signer.getSignatureXml()); diff --git a/test/signature-object-tests.spec.ts b/test/signature-object-tests.spec.ts index f4227d5..23101dc 100644 --- a/test/signature-object-tests.spec.ts +++ b/test/signature-object-tests.spec.ts @@ -27,15 +27,7 @@ const checkSignature = (signedXml: string, signedDoc: Document) => { const signatureNode = select1Ns("//ds:Signature", signedDoc); isDomNode.assertIsNodeLike(signatureNode); verifier.loadSignature(signatureNode); - const valid = verifier.checkSignature(signedXml); - - return { - valid, - errorMessage: verifier - .getReferences() - .flatMap((ref) => ref.validationError?.message || []) - .join(", "), - }; + return verifier.checkSignature(signedXml); }; describe("ds:Object support in XML signatures", function () { @@ -303,8 +295,7 @@ describe("Valid signatures with ds:Object elements", function () { const doc = new xmldom.DOMParser().parseFromString(signedXml); // Verify that the signature is valid - const { valid, errorMessage } = checkSignature(signedXml, doc); - expect(valid, errorMessage).to.be.true; + expect(checkSignature(signedXml, doc)).to.be.true; }); it("should create valid signatures with references to ds:Object", () => { @@ -363,8 +354,7 @@ describe("Valid signatures with ds:Object elements", function () { expect(objectReference.getAttribute("URI")).to.equal("#object1"); // Verify that the signature is valid - const { valid, errorMessage } = checkSignature(signedXml, doc); - expect(valid, errorMessage).to.be.true; + expect(checkSignature(signedXml, doc)).to.be.true; }); it("should create valid signature and generate Id attribute for ds:Object when not provided", function () { @@ -405,8 +395,7 @@ describe("Valid signatures with ds:Object elements", function () { isDomNode.assertIsElementNode(refEl); // Verify that the signature is valid - const { valid, errorMessage } = checkSignature(signedXml, doc); - expect(valid, errorMessage).to.be.true; + expect(checkSignature(signedXml, doc)).to.be.true; }); }); @@ -445,8 +434,7 @@ describe("Should successfuly sign references to ds:KeyInfo elements", function ( isDomNode.assertIsElementNode(referenceEl); // Verify that the signature is valid - const { valid, errorMessage } = checkSignature(signedXml, doc); - expect(valid, errorMessage).to.be.true; + expect(checkSignature(signedXml, doc)).to.be.true; }); it("should create valid signatures with references to ds:KeyInfo when the Id attribute is autogenerated", function () { @@ -487,8 +475,7 @@ describe("Should successfuly sign references to ds:KeyInfo elements", function ( isDomNode.assertIsElementNode(referenceEl); // Verify that the signature is valid - const { valid, errorMessage } = checkSignature(signedXml, doc); - expect(valid, errorMessage).to.be.true; + expect(checkSignature(signedXml, doc)).to.be.true; }); }); @@ -570,8 +557,7 @@ describe("XAdES Object support in XML signatures", function () { isDomNode.assertIsElementNode(elSPRef); // Verify that the signature is valid - const { valid, errorMessage } = checkSignature(signedXml, signedDoc); - expect(valid, errorMessage).to.be.true; + expect(checkSignature(signedXml, signedDoc)).to.be.true; }); }); diff --git a/test/signature-unit-tests.spec.ts b/test/signature-unit-tests.spec.ts index 2545176..3f9439c 100644 --- a/test/signature-unit-tests.spec.ts +++ b/test/signature-unit-tests.spec.ts @@ -901,7 +901,11 @@ describe("Signature unit tests", function () { /* eslint-disable-next-line deprecation/deprecation */ expect(sig.getReferences().length).to.equal(3); - expect(sig.getSignedReferences().length).to.equal(3); + expect(sig.getSignedReferences()).to.deep.equal([ + '', + '', + '', + ]); const digests = [ "b5GCZ2xpP5T7tbLWBTkOl4CYupQ=", @@ -945,12 +949,12 @@ describe("Signature unit tests", function () { }); describe("pass verify signature", function () { + const signatureXPath = + "//*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']"; + function loadSignature(xml: string, idMode?: "wssecurity") { const doc = new xmldom.DOMParser().parseFromString(xml); - const node = xpath.select1( - "//*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']", - doc, - ); + const node = xpath.select1(signatureXPath, doc); isDomNode.assertIsNodeLike(node); const sig = new SignedXml({ idMode }); sig.publicCert = fs.readFileSync("./test/static/client_public.pem"); @@ -964,8 +968,12 @@ describe("Signature unit tests", function () { const sig = loadSignature(xml, mode); const res = sig.checkSignature(xml); expect(res, "expected all signatures to be valid, but some reported invalid").to.be.true; - /* eslint-disable-next-line deprecation/deprecation */ - expect(sig.getSignedReferences().length).to.equal(sig.getReferences().length); + const references = xpath.select( + `(${signatureXPath})[1]/*[local-name(.)='SignedInfo']/*[local-name(.)='Reference']`, + new xmldom.DOMParser().parseFromString(xml), + ); + isDomNode.assertIsArrayOfNodes(references); + expect(sig.getSignedReferences()).to.have.length(references.length); } function failInvalidSignature(file: string, idMode?: "wssecurity") {