Bug 44984 - if base64 is used after xpath expression it should extract only text nodes
Summary: if base64 is used after xpath expression it should extract only text nodes
Status: NEW
Alias: None
Product: Security - Now in JIRA
Classification: Unclassified
Component: C++ Signature (show other bugs)
Version: cvs
Hardware: PC Windows XP
: P2 normal
Target Milestone: ---
Assignee: XML Security Developers Mailing List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-05-13 00:30 UTC by Matej Spiller-Muys
Modified: 2010-05-11 17:25 UTC (History)
0 users



Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Matej Spiller-Muys 2008-05-13 00:30:42 UTC
DSIGTransformBase64.cpp function appendTransformer does not extract text() nodes if input is xpath transformation

if (input->getLastTxfm()->getNodeType() != TXFMBase::DOM_NODE_XPATH_NODESET) then it adds self::text() xpath transformation.

However even if input is already xpath_nodeset it should have self::text() transformation applied.

from standard:
This transform requires an octet stream for input. If an XPath node-set (or sufficiently functional alternative) is given as input, then it is converted to an octet stream by performing operations logically equivalent to 1) applying an XPath transform with expression self::text(), then 2) taking the string-value of the node-set. Thus, if an XML element is identified by a barename XPointer in the Reference URI, and its content consists solely of base64 encoded character data, then this transform automatically strips away the start and end tags of the identified element and any of its descendant elements as well as any descendant comments and processing instructions. The output of this transform is an octet stream.
Comment 1 Scott Cantor 2010-05-11 17:25:49 UTC
Just looking at this, and my suspicion is that the check is in there because the code provided to add the self::text() transform would break or not do the right thing if the input is XPath.

Have you tested with the change of removing the getNodeType check altogether?