Exception signing document

["Evaristo Jose Camarero (ML/EEM)" <ev...@ericsson.com>]

Hi all:

I'm trying to sign an XML document with xml-sec-1.05D2 using a reference attribute of type IDType. I see a very strange problem. If the attribute is called id, then the sign method works fine, but if the attribute is called for instance RequestID, then I obtain the following problem. Any clue?

org.apache.xml.security.signature.XMLSignatureException: input node set contains no nodes
Original Exception was org.apache.xml.security.signature.ReferenceNotInitializedException: input node set contains no nodes
Original Exception was org.apache.xml.security.signature.ReferenceNotInitializedException: input node set contains no nodes
Original Exception was org.apache.xml.security.signature.XMLSignatureException: input node set contains no nodes
Original Exception was org.apache.xml.security.transforms.TransformationException: input node set contains no nodes


Thanks in advance,

Evaristo Camarero
Ericsson R&D

Re: Exception signing document

[Erwin van der Koogh <vd...@apache.org>]

> You need to register the element containing the RequestID attribute
> before signing, ex:
>
>    org.apache.xml.security.utils.IDResolver.registerElementById(element,
> requestIdAttrValue);

Correct.

[snip..]

> The code to search for ID attributes named "id"/"Id"/"ID" should probably
> be removed, because it is possible you might sign something that you
> didn't
> mean to sign.

I didn't write the original code and I am not overly fond of it, but I don't
really see a better solution at this particular time. If people have a 
better idea on how to do this, please let me know :)

[snip..]

Erwin

Re: Exception signing document

[Sean Mullan <se...@sun.com>]

You need to register the element containing the RequestID attribute
before signing, ex:

   org.apache.xml.security.utils.IDResolver.registerElementById(element, requestIdAttrValue);

If you don't register the element, when the xml-security library tries to
dereference the Reference fragment URI, it uses an inefficient and
insecure mechanism to search the entire Document for attributes named
"id" or "ID" or "Id", but if it is named something else, it does not
know how to find it, so you need to explicitly register it. You should
always register it anyway, since performance and security will be improved.

The code to search for ID attributes named "id"/"Id"/"ID" should probably
be removed, because it is possible you might sign something that you didn't
mean to sign.

Also, before you validate the signature, you may need to register the element
containing the RequestId attribute unless you use a validating parser to
create the DOM document object containing the XML Signature using a schema/DTD
that defines the RequestID attribute to be of type ID.

--Sean

Evaristo Jose Camarero (ML/EEM) wrote:
> Hi all:
> 
> I'm trying to sign an XML document with xml-sec-1.05D2 using a reference attribute of type IDType. I see a very strange problem. If the attribute is called id, then the sign method works fine, but if the attribute is called for instance RequestID, then I obtain the following problem. Any clue?
> 
> org.apache.xml.security.signature.XMLSignatureException: input node set contains no nodes
> Original Exception was org.apache.xml.security.signature.ReferenceNotInitializedException: input node set contains no nodes
> Original Exception was org.apache.xml.security.signature.ReferenceNotInitializedException: input node set contains no nodes
> Original Exception was org.apache.xml.security.signature.XMLSignatureException: input node set contains no nodes
> Original Exception was org.apache.xml.security.transforms.TransformationException: input node set contains no nodes
> 
> 
> Thanks in advance,
> 
> Evaristo Camarero
> Ericsson R&D