diff --git a/test/document-tests.spec.ts b/test/document-tests.spec.ts
index b831199..2d0c0cf 100644
--- a/test/document-tests.spec.ts
+++ b/test/document-tests.spec.ts
@@ -132,3 +132,22 @@ describe("Validated node references tests", function () {
expect(sig.getSignedReferences().length).to.equal(0);
});
});
+
+describe("Signed reference tests", function () {
+ it("should read signed data from the signed references", function () {
+ const xml = fs.readFileSync("./test/static/valid_saml.xml", "utf-8");
+ const doc = new xmldom.DOMParser().parseFromString(xml);
+ const sig = new SignedXml();
+ sig.getCertFromKeyInfo = SignedXml.getCertFromKeyInfo;
+ sig.loadSignature(sig.findSignatures(doc)[0]);
+ expect(sig.checkSignature(xml)).to.be.true;
+
+ const signedDoc = new xmldom.DOMParser().parseFromString(sig.getSignedReferences()[0]);
+ const mail = xpath.select1(
+ "//*[local-name()='Attribute' and @Name='mail']/*[local-name()='AttributeValue']/text()",
+ signedDoc,
+ );
+ isDomNode.assertIsNodeLike(mail);
+ expect(mail.nodeValue).to.equal("henri.bergius@nemein.com");
+ });
+});
diff --git a/test/signature-integration-tests.spec.ts b/test/signature-integration-tests.spec.ts
index 6025843..2fd41c5 100644
--- a/test/signature-integration-tests.spec.ts
+++ b/test/signature-integration-tests.spec.ts
@@ -783,8 +783,17 @@ describe("Signature integration tests", function () {
reference: "/root[not(@Id)]",
detached: false,
},
- { name: "creates a verifiable detached signature", reference: "/*", detached: true },
- ]) {
+ {
+ name: "creates a verifiable detached signature",
+ reference: "/*",
+ detached: "generated IDs",
+ },
+ {
+ name: "creates a verifiable detached signature over elements that carry their IDs",
+ reference: "/*",
+ detached: "input IDs",
+ },
+ ] as const) {
it(name, async function () {
const signer = new SignedXml({
privateKey,
@@ -797,7 +806,8 @@ describe("Signature integration tests", function () {
digestAlgorithm: "http://www.w3.org/2001/04/xmlenc#sha256",
});
- const xml = "trusted";
+ const xml =
+ detached === "input IDs" ? 'trusted' : "trusted";
if (useCallback) {
await new Promise((resolve, reject) => {
signer.computeSignature(xml, (err) => (err ? reject(err) : resolve()));
@@ -806,10 +816,12 @@ describe("Signature integration tests", function () {
signer.computeSignature(xml);
}
- const signedXml = detached
- ? // eslint-disable-next-line deprecation/deprecation
- signer.getOriginalXmlWithIds()
- : signer.getSignedXml();
+ const signedXml = !detached
+ ? signer.getSignedXml()
+ : detached === "input IDs"
+ ? xml
+ : // eslint-disable-next-line deprecation/deprecation
+ signer.getOriginalXmlWithIds();
const verifier = new SignedXml({ publicCert });
verifier.loadSignature(signer.getSignatureXml());
diff --git a/test/signature-object-tests.spec.ts b/test/signature-object-tests.spec.ts
index f4227d5..23101dc 100644
--- a/test/signature-object-tests.spec.ts
+++ b/test/signature-object-tests.spec.ts
@@ -27,15 +27,7 @@ const checkSignature = (signedXml: string, signedDoc: Document) => {
const signatureNode = select1Ns("//ds:Signature", signedDoc);
isDomNode.assertIsNodeLike(signatureNode);
verifier.loadSignature(signatureNode);
- const valid = verifier.checkSignature(signedXml);
-
- return {
- valid,
- errorMessage: verifier
- .getReferences()
- .flatMap((ref) => ref.validationError?.message || [])
- .join(", "),
- };
+ return verifier.checkSignature(signedXml);
};
describe("ds:Object support in XML signatures", function () {
@@ -303,8 +295,7 @@ describe("Valid signatures with ds:Object elements", function () {
const doc = new xmldom.DOMParser().parseFromString(signedXml);
// Verify that the signature is valid
- const { valid, errorMessage } = checkSignature(signedXml, doc);
- expect(valid, errorMessage).to.be.true;
+ expect(checkSignature(signedXml, doc)).to.be.true;
});
it("should create valid signatures with references to ds:Object", () => {
@@ -363,8 +354,7 @@ describe("Valid signatures with ds:Object elements", function () {
expect(objectReference.getAttribute("URI")).to.equal("#object1");
// Verify that the signature is valid
- const { valid, errorMessage } = checkSignature(signedXml, doc);
- expect(valid, errorMessage).to.be.true;
+ expect(checkSignature(signedXml, doc)).to.be.true;
});
it("should create valid signature and generate Id attribute for ds:Object when not provided", function () {
@@ -405,8 +395,7 @@ describe("Valid signatures with ds:Object elements", function () {
isDomNode.assertIsElementNode(refEl);
// Verify that the signature is valid
- const { valid, errorMessage } = checkSignature(signedXml, doc);
- expect(valid, errorMessage).to.be.true;
+ expect(checkSignature(signedXml, doc)).to.be.true;
});
});
@@ -445,8 +434,7 @@ describe("Should successfuly sign references to ds:KeyInfo elements", function (
isDomNode.assertIsElementNode(referenceEl);
// Verify that the signature is valid
- const { valid, errorMessage } = checkSignature(signedXml, doc);
- expect(valid, errorMessage).to.be.true;
+ expect(checkSignature(signedXml, doc)).to.be.true;
});
it("should create valid signatures with references to ds:KeyInfo when the Id attribute is autogenerated", function () {
@@ -487,8 +475,7 @@ describe("Should successfuly sign references to ds:KeyInfo elements", function (
isDomNode.assertIsElementNode(referenceEl);
// Verify that the signature is valid
- const { valid, errorMessage } = checkSignature(signedXml, doc);
- expect(valid, errorMessage).to.be.true;
+ expect(checkSignature(signedXml, doc)).to.be.true;
});
});
@@ -570,8 +557,7 @@ describe("XAdES Object support in XML signatures", function () {
isDomNode.assertIsElementNode(elSPRef);
// Verify that the signature is valid
- const { valid, errorMessage } = checkSignature(signedXml, signedDoc);
- expect(valid, errorMessage).to.be.true;
+ expect(checkSignature(signedXml, signedDoc)).to.be.true;
});
});
diff --git a/test/signature-unit-tests.spec.ts b/test/signature-unit-tests.spec.ts
index 2545176..3f9439c 100644
--- a/test/signature-unit-tests.spec.ts
+++ b/test/signature-unit-tests.spec.ts
@@ -901,7 +901,11 @@ describe("Signature unit tests", function () {
/* eslint-disable-next-line deprecation/deprecation */
expect(sig.getReferences().length).to.equal(3);
- expect(sig.getSignedReferences().length).to.equal(3);
+ expect(sig.getSignedReferences()).to.deep.equal([
+ '',
+ '',
+ '',
+ ]);
const digests = [
"b5GCZ2xpP5T7tbLWBTkOl4CYupQ=",
@@ -945,12 +949,12 @@ describe("Signature unit tests", function () {
});
describe("pass verify signature", function () {
+ const signatureXPath =
+ "//*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']";
+
function loadSignature(xml: string, idMode?: "wssecurity") {
const doc = new xmldom.DOMParser().parseFromString(xml);
- const node = xpath.select1(
- "//*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']",
- doc,
- );
+ const node = xpath.select1(signatureXPath, doc);
isDomNode.assertIsNodeLike(node);
const sig = new SignedXml({ idMode });
sig.publicCert = fs.readFileSync("./test/static/client_public.pem");
@@ -964,8 +968,12 @@ describe("Signature unit tests", function () {
const sig = loadSignature(xml, mode);
const res = sig.checkSignature(xml);
expect(res, "expected all signatures to be valid, but some reported invalid").to.be.true;
- /* eslint-disable-next-line deprecation/deprecation */
- expect(sig.getSignedReferences().length).to.equal(sig.getReferences().length);
+ const references = xpath.select(
+ `(${signatureXPath})[1]/*[local-name(.)='SignedInfo']/*[local-name(.)='Reference']`,
+ new xmldom.DOMParser().parseFromString(xml),
+ );
+ isDomNode.assertIsArrayOfNodes(references);
+ expect(sig.getSignedReferences()).to.have.length(references.length);
}
function failInvalidSignature(file: string, idMode?: "wssecurity") {