[jira] [Commented] (SANTUARIO-585) Contents extraction by XPointer URI

["Sean Mullan (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SANTUARIO-585?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17803296#comment-17803296 ] 

Sean Mullan commented on SANTUARIO-585:
---------------------------------------

??From my testing, it seems like Santuario is able to process only a whole-document xpointer reference like "xpointer", but not xpointers pointing to a particular element within an XML document.??

Yes. Only same-document XPointers '#xpointer(/)' and '#xpointer(id('ID'))' are supported.

> Contents extraction by XPointer URI
> -----------------------------------
>
>                 Key: SANTUARIO-585
>                 URL: https://issues.apache.org/jira/browse/SANTUARIO-585
>             Project: Santuario
>          Issue Type: Bug
>          Components: Java
>    Affects Versions: Java 2.2.3
>            Reporter: Aleksandr Beliakov
>            Assignee: Colm O hEigeartaigh
>            Priority: Minor
>         Attachments: signed_partial_invoice.xml
>
>
> Hello,
>  
> One of our users faced with an issue when de-referencing the content of a _ds:Reference_ element containing an xpointer-based URI.
> For instance, we have a _ds:Reference_ looking like:
> {code:java}
> <ds:Reference URI="#xmlns(ns0=http://www.ebinterface.at/schema/3p02/)xpointer(/ns0%3AInvoice%5B1%5D)">
> ...
> </ds:Reference> {code}
> That should refer an _<Invoice>_ element with with a namespace {_}"http://www.ebinterface.at/schema/3p02/"{_}.
>  
> Unfortunately, Santuario fails to de-reference the content by throwing the exception:
> {code:java}
> Caused by: org.apache.xml.security.utils.resolver.ResourceResolverException: Cannot resolve element with ID xmlns(ns0=http://www.ebinterface.at/schema/3p02/)xpointer(/ns0%3AInvoice%5B1%5D)
>     at org.apache.xml.security.utils.resolver.implementations.ResolverFragment.engineResolveURI(ResolverFragment.java:73)
>     at org.apache.xml.security.utils.resolver.ResourceResolver.resolve(ResourceResolver.java:154)
>     at org.apache.xml.security.utils.resolver.ResourceResolver.resolve(ResourceResolver.java:193)
>     at org.apache.xml.security.signature.Reference.getContentsBeforeTransformation(Reference.java:436){code}
> Unit test demonstrating the issue is below:
> {code:java}
> org.apache.xml.security.Init.init();
> FileInputStream fis = new FileInputStream("signed_partial_invoice.xml");
> DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
> documentBuilderFactory.setNamespaceAware(true);
> Document document = documentBuilderFactory.newDocumentBuilder().parse(fis);
> Element rootElement = document.getDocumentElement();
> NodeList childNodes = rootElement.getChildNodes();
> Element signatureElement = null;
> for (int i = 0; i < childNodes.getLength(); i++) {
>     Node child = childNodes.item(i);
>     if (child.getNodeType() == Node.ELEMENT_NODE) {
>         Element elementChild = (Element) child;
>         if (elementChild.getNodeName().equals("ds:Signature")) {
>             signatureElement = elementChild;
>         }
>     }
> }
> assertNotNull(signatureElement);
> XMLSignature santuarioSignature = new XMLSignature(signatureElement, "", false);
> SignedInfo signedInfo = santuarioSignature.getSignedInfo();
> Reference reference = signedInfo.item(0);
> assertNotNull(reference.getContentsBeforeTransformation()); {code}
>  
> We have a couple of questions:
> 1) Does Santuario support XPointer-based URIs?
> 2) Is URL-escaping supported within ds:Reference URI?
> 3) Is the xpointer-reference correct in the example?
>  
> From my testing, it seems like Santuario is able to process only a whole-document xpointer reference like "xpointer(/)", but not xpointers pointing to a particular element within an XML document.
>  
> Could you please give us some explanations about the problem?
>  
> For more information about the issue, please have a look on the ticket : [DSS-2675|https://ec.europa.eu/cefdigital/tracker/browse/DSS-2675].
>  
> Thank you in advance.
>  
> Best regards,
> Aleksandr.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)