test: prove behavior through supported APIs instead of deprecated ones

test/document-tests.spec.ts

@@ -132,3 +132,22 @@ describe("Validated node references tests", function () {
     expect(sig.getSignedReferences().length).to.equal(0);
   });
 });
+
+describe("Signed reference tests", function () {
+  it("should read signed data from the signed references", function () {
+    const xml = fs.readFileSync("./test/static/valid_saml.xml", "utf-8");
+    const doc = new xmldom.DOMParser().parseFromString(xml);
+    const sig = new SignedXml();
+    sig.getCertFromKeyInfo = SignedXml.getCertFromKeyInfo;
+    sig.loadSignature(sig.findSignatures(doc)[0]);
+    expect(sig.checkSignature(xml)).to.be.true;
+
+    const signedDoc = new xmldom.DOMParser().parseFromString(sig.getSignedReferences()[0]);
+    const mail = xpath.select1(
+      "//*[local-name()='Attribute' and @Name='mail']/*[local-name()='AttributeValue']/text()",
+      signedDoc,
+    );
+    isDomNode.assertIsNodeLike(mail);
+    expect(mail.nodeValue).to.equal("henri.bergius@nemein.com");
+  });
+});

test/signature-integration-tests.spec.ts

@@ -783,8 +783,17 @@ describe("Signature integration tests", function () {
             reference: "/root[not(@Id)]",
             detached: false,
           },
-          { name: "creates a verifiable detached signature", reference: "/*", detached: true },
-        ]) {
+          {
+            name: "creates a verifiable detached signature",
+            reference: "/*",
+            detached: "generated IDs",
+          },
+          {
+            name: "creates a verifiable detached signature over elements that carry their IDs",
+            reference: "/*",
+            detached: "input IDs",
+          },
+        ] as const) {
           it(name, async function () {
             const signer = new SignedXml({
               privateKey,
@@ -797,7 +806,8 @@ describe("Signature integration tests", function () {
               digestAlgorithm: "http://www.w3.org/2001/04/xmlenc#sha256",
             });
 
-            const xml = "<root>trusted</root>";
+            const xml =
+              detached === "input IDs" ? '<root Id="_0">trusted</root>' : "<root>trusted</root>";
             if (useCallback) {
               await new Promise<void>((resolve, reject) => {
                 signer.computeSignature(xml, (err) => (err ? reject(err) : resolve()));
@@ -806,10 +816,12 @@ describe("Signature integration tests", function () {
               signer.computeSignature(xml);
             }
 
-            const signedXml = detached
-              ? // eslint-disable-next-line deprecation/deprecation
-                signer.getOriginalXmlWithIds()
-              : signer.getSignedXml();
+            const signedXml = !detached
+              ? signer.getSignedXml()
+              : detached === "input IDs"
+                ? xml
+                : // eslint-disable-next-line deprecation/deprecation
+                  signer.getOriginalXmlWithIds();
             const verifier = new SignedXml({ publicCert });
             verifier.loadSignature(signer.getSignatureXml());
 

test/signature-object-tests.spec.ts

@@ -27,15 +27,7 @@ const checkSignature = (signedXml: string, signedDoc: Document) => {
   const signatureNode = select1Ns("//ds:Signature", signedDoc);
   isDomNode.assertIsNodeLike(signatureNode);
   verifier.loadSignature(signatureNode);
-  const valid = verifier.checkSignature(signedXml);
-
-  return {
-    valid,
-    errorMessage: verifier
-      .getReferences()
-      .flatMap((ref) => ref.validationError?.message || [])
-      .join(", "),
-  };
+  return verifier.checkSignature(signedXml);
 };
 
 describe("ds:Object support in XML signatures", function () {
@@ -303,8 +295,7 @@ describe("Valid signatures with ds:Object elements", function () {
     const doc = new xmldom.DOMParser().parseFromString(signedXml);
 
     // Verify that the signature is valid
-    const { valid, errorMessage } = checkSignature(signedXml, doc);
-    expect(valid, errorMessage).to.be.true;
+    expect(checkSignature(signedXml, doc)).to.be.true;
   });
 
   it("should create valid signatures with references to ds:Object", () => {
@@ -363,8 +354,7 @@ describe("Valid signatures with ds:Object elements", function () {
     expect(objectReference.getAttribute("URI")).to.equal("#object1");
 
     // Verify that the signature is valid
-    const { valid, errorMessage } = checkSignature(signedXml, doc);
-    expect(valid, errorMessage).to.be.true;
+    expect(checkSignature(signedXml, doc)).to.be.true;
   });
 
   it("should create valid signature and generate Id attribute for ds:Object when not provided", function () {
@@ -405,8 +395,7 @@ describe("Valid signatures with ds:Object elements", function () {
     isDomNode.assertIsElementNode(refEl);
 
     // Verify that the signature is valid
-    const { valid, errorMessage } = checkSignature(signedXml, doc);
-    expect(valid, errorMessage).to.be.true;
+    expect(checkSignature(signedXml, doc)).to.be.true;
   });
 });
 
@@ -445,8 +434,7 @@ describe("Should successfuly sign references to ds:KeyInfo elements", function (
     isDomNode.assertIsElementNode(referenceEl);
 
     // Verify that the signature is valid
-    const { valid, errorMessage } = checkSignature(signedXml, doc);
-    expect(valid, errorMessage).to.be.true;
+    expect(checkSignature(signedXml, doc)).to.be.true;
   });
 
   it("should create valid signatures with references to ds:KeyInfo when the Id attribute is autogenerated", function () {
@@ -487,8 +475,7 @@ describe("Should successfuly sign references to ds:KeyInfo elements", function (
     isDomNode.assertIsElementNode(referenceEl);
 
     // Verify that the signature is valid
-    const { valid, errorMessage } = checkSignature(signedXml, doc);
-    expect(valid, errorMessage).to.be.true;
+    expect(checkSignature(signedXml, doc)).to.be.true;
   });
 });
 
@@ -570,8 +557,7 @@ describe("XAdES Object support in XML signatures", function () {
     isDomNode.assertIsElementNode(elSPRef);
 
     // Verify that the signature is valid
-    const { valid, errorMessage } = checkSignature(signedXml, signedDoc);
-    expect(valid, errorMessage).to.be.true;
+    expect(checkSignature(signedXml, signedDoc)).to.be.true;
   });
 });
 

test/signature-unit-tests.spec.ts

@@ -901,7 +901,11 @@ describe("Signature unit tests", function () {
 
         /* eslint-disable-next-line deprecation/deprecation */
         expect(sig.getReferences().length).to.equal(3);
-        expect(sig.getSignedReferences().length).to.equal(3);
+        expect(sig.getSignedReferences()).to.deep.equal([
+          '<x xmlns="ns" Id="_0"></x>',
+          '<y Id="_1" a_attr1="foo" z_attr="value"></y>',
+          '<ns:w xmlns:ns="myns" Id="_2" ns:attr="value"></ns:w>',
+        ]);
 
         const digests = [
           "b5GCZ2xpP5T7tbLWBTkOl4CYupQ=",
@@ -945,12 +949,12 @@ describe("Signature unit tests", function () {
     });
 
     describe("pass verify signature", function () {
+      const signatureXPath =
+        "//*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']";
+
       function loadSignature(xml: string, idMode?: "wssecurity") {
         const doc = new xmldom.DOMParser().parseFromString(xml);
-        const node = xpath.select1(
-          "//*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']",
-          doc,
-        );
+        const node = xpath.select1(signatureXPath, doc);
         isDomNode.assertIsNodeLike(node);
         const sig = new SignedXml({ idMode });
         sig.publicCert = fs.readFileSync("./test/static/client_public.pem");
@@ -964,8 +968,12 @@ describe("Signature unit tests", function () {
         const sig = loadSignature(xml, mode);
         const res = sig.checkSignature(xml);
         expect(res, "expected all signatures to be valid, but some reported invalid").to.be.true;
-        /* eslint-disable-next-line deprecation/deprecation */
-        expect(sig.getSignedReferences().length).to.equal(sig.getReferences().length);
+        const references = xpath.select(
+          `(${signatureXPath})[1]/*[local-name(.)='SignedInfo']/*[local-name(.)='Reference']`,
+          new xmldom.DOMParser().parseFromString(xml),
+        );
+        isDomNode.assertIsArrayOfNodes(references);
+        expect(sig.getSignedReferences()).to.have.length(references.length);
       }
 
       function failInvalidSignature(file: string, idMode?: "wssecurity") {