SignedElementTrait::validateReferenceUri() - Code Metrics - simplesamlphp/xml-security - Measure and Improve Code Quality continuously with Scrutinizer

SignedElementTrait::validateReferenceUri() A
last analyzed 2025-08-12 11:32 UTC

↳ Parent: SignedElementTrait

Complexity

Conditions	5
Paths	3

Size

Total Lines	38
Code Lines	25

Duplication

Lines	0
Ratio	0 %

Importance

Changes	2
Bugs	0	Features	0

Metric	Value
cc	5
eloc	25
c	2
b	0
f	0
nc	3
nop	2
dl	0
loc	38
rs	9.2088

<?php

declare(strict_types=1);

namespace SimpleSAML\XMLSecurity\XML;

use DOMElement;
use SimpleSAML\Assert\Assert;
use SimpleSAML\XML\DOMDocumentFactory;
use SimpleSAML\XMLSchema\Type\IDValue;
use SimpleSAML\XMLSchema\Exception\TooManyElementsException;
use SimpleSAML\XMLSecurity\Alg\Signature\{SignatureAlgorithmFactory, SignatureAlgorithmInterface};
use SimpleSAML\XMLSecurity\Constants as C;
use SimpleSAML\XMLSecurity\CryptoEncoding\PEM;
use SimpleSAML\XMLSecurity\Exception\{
    InvalidArgumentException,
    NoSignatureFoundException,
    ReferenceValidationFailedException,
    RuntimeException,
    SignatureVerificationFailedException,
};
use SimpleSAML\XMLSecurity\Key;
use SimpleSAML\XMLSecurity\Key\KeyInterface;
use SimpleSAML\XMLSecurity\Utils\{XML, XPath};
use SimpleSAML\XMLSecurity\XML\ds\{
    Reference,
    Signature,
    SignedInfo,
    X509Certificate,
    X509Data,
};

use function base64_decode;
use function hash;
use function hash_equals;
use function in_array;
use function strval;

/**
 * Helper trait for processing signed elements.
 *
 * @package simplesamlphp/xml-security
 */
trait SignedElementTrait
{
    use CanonicalizableElementTrait;

    /**
     * The signature of this element.
     *
     * @var \SimpleSAML\XMLSecurity\XML\ds\Signature|null $signature
     */
    protected ?Signature $signature = null;

    /**
     * The key that successfully verifies the signature in this object.
     *
     * @var \SimpleSAML\XMLSecurity\Key\KeyInterface|null
     */
    private ?KeyInterface $validatingKey = null;


    /**
     * Get the signature element of this object.
     *
     * @return \SimpleSAML\XMLSecurity\XML\ds\Signature
     */
    public function getSignature(): ?Signature
    {
        return $this->signature;
    }


    /**
     * Initialize a signed element from XML.
     *
     * @param \SimpleSAML\XMLSecurity\XML\ds\Signature $signature The ds:Signature object
     */
    protected function setSignature(Signature $signature): void
    {
        /**
         * By disabling formatting on signed objects, we prevent issues with invalid signatures later on
         * at the cost of some whitespace taking up useless bytes in the outputted document.
         */
        $this->formatOutput = false;

        $this->signature = $signature;
    }


    /**
     * Make sure the given Reference points to the original XML given.
     */
    private function validateReferenceUri(Reference $reference, DOMElement $xml): void
    {
        if (
            in_array(
                $this->getSignature()->getSignedInfo()->getCanonicalizationMethod()->getAlgorithm(),
                [
                    C::C14N_INCLUSIVE_WITH_COMMENTS,
                    C::C14N_EXCLUSIVE_WITH_COMMENTS,
                ],
            )
            && !$reference->isXPointer()
        ) { // canonicalization with comments used, but reference wasn't an xpointer!
            throw new ReferenceValidationFailedException('Invalid reference for canonicalization algorithm.');
        }

        $id = $this->getId();
        $uri = $reference->getURI();

        if (empty($uri) || $uri->getValue() === '#xpointer(/)') { // same-document reference
            Assert::true(
                $xml->isSameNode($xml->ownerDocument->documentElement),
                'Cannot use document reference when element is not the root of the document.',
                ReferenceValidationFailedException::class,
            );
        } else { // short-name or scheme-based xpointer
            Assert::notEmpty(
                $id,
                'Reference points to an element, but given element does not have an ID.',
                ReferenceValidationFailedException::class,
            );
            Assert::oneOf(
                $uri->getValue(),
                [
                    '#' . $id->getValue(),
                    '#xpointer(id(' . $id->getValue() . '))',
                ],
                'Reference does not point to given element.',
                ReferenceValidationFailedException::class,
            );
        }
    }


    /**
     * @param \SimpleSAML\XMLSecurity\XML\ds\SignedInfo $signedInfo
     * @return \SimpleSAML\XMLSecurity\XML\SignedElementInterface
     */
    private function validateReference(SignedInfo $signedInfo): SignedElementInterface
    {
        $xml = $this->getOriginalXML();
        $references = $signedInfo->getReferences();
        foreach ($references as $reference) {
            $this->validateReferenceUri($reference, $xml);
        }

        // Clone the document so we don't mess up the original DOMDocument
        $doc = DOMDocumentFactory::create();
        $node = $doc->importNode($xml->ownerDocument->documentElement, true);
        $doc->appendChild($node);

        $xp = XPath::getXPath($doc);
        $sigNode = XPath::xpQuery($doc->documentElement, 'child::ds:Signature', $xp);
        Assert::minCount($sigNode, 1, NoSignatureFoundException::class);
        Assert::maxCount($sigNode, 1, 'More than one signature found in object.', TooManyElementsException::class);

        $doc->documentElement->removeChild($sigNode[0]);
        $data = XML::processTransforms($reference->getTransforms(), $doc->documentElement);

        $algo = $reference->getDigestMethod()->getAlgorithm()->getValue();
        Assert::keyExists(
            C::$DIGEST_ALGORITHMS,
            $algo,
            'Unsupported digest method "' . $algo . '"',
            InvalidArgumentException::class,
        );

        $digest = hash(C::$DIGEST_ALGORITHMS[$algo], $data, true);
        if (
            hash_equals(
                $digest,
                base64_decode($reference->getDigestValue()->getContent()->getValue(), true),
            ) !== true
        ) {
            throw new SignatureVerificationFailedException('Failed to verify signature.');
        }

        $verifiedXml = DOMDocumentFactory::fromString($data);
        return static::fromXML($verifiedXml->documentElement);
    }


    /**
     * Verify this element against a public key.
     *
     * true is returned on success, false is returned if we don't have any
     * signature we can verify. An exception is thrown if the signature
     * validation fails.
     *
     * @param \SimpleSAML\XMLSecurity\Alg\Signature\SignatureAlgorithmInterface|null $verifier The verifier to use to
     * verify the signature. If null, attempt to verify it with the KeyInfo information in the signature.
     *
     * @return \SimpleSAML\XMLSecurity\XML\SignedElementInterface The Signed element if it was verified.
     */
    private function verifyInternal(SignatureAlgorithmInterface $verifier): SignedElementInterface
    {
        /** @var \SimpleSAML\XMLSecurity\XML\ds\Signature $this->signature */
        $signedInfo = $this->getSignature()->getSignedInfo();
        $c14nAlg = $signedInfo->getCanonicalizationMethod()->getAlgorithm();

        // the canonicalized ds:SignedInfo element (plaintext)
        $c14nSignedInfo = $signedInfo->canonicalize($c14nAlg->getValue());
        $ref = $this->validateReference(
            SignedInfo::fromXML(DOMDocumentFactory::fromString($c14nSignedInfo)->documentElement),
        );

        if (
            $verifier?->verify(
                $c14nSignedInfo, // the canonicalized ds:SignedInfo element (plaintext)
                // the actual signature
                base64_decode(strval($this->getSignature()->getSignatureValue()->getValue()), true),
            )
        ) {
            /*
             * validateReference() returns an object of the same class using this trait. This means the validatingKey
             * property is available, and we can set it on the newly created object because we are in the same class,
             * even thought the property itself is private.
             */
            $ref->validatingKey = $verifier->getKey();

            return $ref;
        }
        throw new SignatureVerificationFailedException('Failed to verify signature.');
    }


    /**
     * Retrieve certificates that sign this element.
     *
     * @return \SimpleSAML\XMLSecurity\Key\KeyInterface|null The key that successfully verified this signature.
     */
    public function getVerifyingKey(): ?KeyInterface
    {
        return $this->validatingKey;
    }


    /**
     * Whether this object is signed or not.
     *
     * @return bool
     */
    public function isSigned(): bool
    {
        return $this->signature !== null;
    }


    /**
     * Verify the signature in this object.
     *
     * If no signature is present, false is returned. If a signature is present,
     * but cannot be verified, an exception will be thrown.
     *
     * @param \SimpleSAML\XMLSecurity\Alg\Signature\SignatureAlgorithmInterface|null $verifier The verifier to use to
     * verify the signature. If null, attempt to verify it with the KeyInfo information in the signature.
     * @return \SimpleSAML\XMLSecurity\XML\SignedElementInterface The object processed again from its canonicalised
     * representation verified by the signature.
     * @throws \SimpleSAML\XMLSecurity\Exception\NoSignatureFoundException if the object is not signed.
     * @throws \SimpleSAML\XMLSecurity\Exception\InvalidArgumentException if no key is passed and there is no KeyInfo
     * in the signature.
     * @throws \SimpleSAML\XMLSecurity\Exception\RuntimeException if the signature fails to verify.
     */
    public function verify(?SignatureAlgorithmInterface $verifier = null): SignedElementInterface
    {
        if (!$this->isSigned()) {
            throw new NoSignatureFoundException();
        }

        $keyInfo = $this->signature?->getKeyInfo();
        $algId = $this->signature->getSignedInfo()->getSignatureMethod()->getAlgorithm();
        if ($verifier === null && $keyInfo === null) {
            throw new InvalidArgumentException('No key or KeyInfo available for signature verification.');
        }

        if ($verifier !== null) {
            // verify using given key
            // TODO: make this part of the condition, so that we support using this verifier to decrypt an encrypted key
            Assert::eq(
                $verifier->getAlgorithmId(),
                $algId,
                'Algorithm provided in key does not match algorithm used in signature.',
            );

            return $this->verifyInternal($verifier);
        }

        $factory = new SignatureAlgorithmFactory();
        foreach ($keyInfo->getInfo() as $info) {
            if (!$info instanceof X509Data) {
                continue;
            }

            foreach ($info->getData() as $data) {
                if (!$data instanceof X509Certificate) {
                    // not supported
                    continue;
                }

                // build a valid PEM for the certificate
                $cert = sprintf(
                    "-----BEGIN CERTIFICATE-----\n%s\n-----END CERTIFICATE-----",
                    strval($data->getContent()),
                );

                $cert = new Key\X509Certificate(PEM::fromString($cert));
                $verifier = $factory->getAlgorithm($algId->getValue(), $cert->getPublicKey());

                try {
                    return $this->verifyInternal($verifier);
                } catch (RuntimeException) {
                    // failed to verify with this certificate, try with other, if any
                }
            }
        }
        throw new SignatureVerificationFailedException('Failed to verify signature.');
    }


    /**
     * @return \SimpleSAML\XML\Type\IDValue|null
     */
    abstract public function getId(): ?IDValue;


    /**
     * Get the list of algorithms that are blacklisted for any signing operation.
     *
     * @return string[]|null An array with all algorithm identifiers that are blacklisted, or null to use this
     * libraries default.
     */
    abstract public function getBlacklistedAlgorithms(): ?array;
}


1			<?php
2
3			declare(strict_types=1);
4
5			namespace SimpleSAML\XMLSecurity\XML;
6
7			use DOMElement;
8			use SimpleSAML\Assert\Assert;
9			use SimpleSAML\XML\DOMDocumentFactory;
10			use SimpleSAML\XMLSchema\Type\IDValue;
11			use SimpleSAML\XMLSchema\Exception\TooManyElementsException;
12			use SimpleSAML\XMLSecurity\Alg\Signature\{SignatureAlgorithmFactory, SignatureAlgorithmInterface};
13			use SimpleSAML\XMLSecurity\Constants as C;
14			use SimpleSAML\XMLSecurity\CryptoEncoding\PEM;
15			use SimpleSAML\XMLSecurity\Exception\{
16			InvalidArgumentException,
17			NoSignatureFoundException,
18			ReferenceValidationFailedException,
19			RuntimeException,
20			SignatureVerificationFailedException,
21			};
22			use SimpleSAML\XMLSecurity\Key;
23			use SimpleSAML\XMLSecurity\Key\KeyInterface;
24			use SimpleSAML\XMLSecurity\Utils\{XML, XPath};
25			use SimpleSAML\XMLSecurity\XML\ds\{
26			Reference,
27			Signature,
28			SignedInfo,
29			X509Certificate,
30			X509Data,
31			};
32
33			use function base64_decode;
34			use function hash;
35			use function hash_equals;
36			use function in_array;
37			use function strval;
38
39			/**
40			* Helper trait for processing signed elements.
41			*
42			* @package simplesamlphp/xml-security
43			*/
44			trait SignedElementTrait
45			{
46			use CanonicalizableElementTrait;
47
48			/**
49			* The signature of this element.
50			*
51			* @var \SimpleSAML\XMLSecurity\XML\ds\Signature\|null $signature
52			*/
53			protected ?Signature $signature = null;
54
55			/**
56			* The key that successfully verifies the signature in this object.
57			*
58			* @var \SimpleSAML\XMLSecurity\Key\KeyInterface\|null
59			*/
60			private ?KeyInterface $validatingKey = null;
61
62
63			/**
64			* Get the signature element of this object.
65			*
66			* @return \SimpleSAML\XMLSecurity\XML\ds\Signature
67			*/
68			public function getSignature(): ?Signature
69			{
70			return $this->signature;
71			}
72
73
74			/**
75			* Initialize a signed element from XML.
76			*
77			* @param \SimpleSAML\XMLSecurity\XML\ds\Signature $signature The ds:Signature object
78			*/
79			protected function setSignature(Signature $signature): void
80			{
81			/**
82			* By disabling formatting on signed objects, we prevent issues with invalid signatures later on
83			* at the cost of some whitespace taking up useless bytes in the outputted document.
84			*/
85			$this->formatOutput = false;
			0 ignored issues – show Bug Best Practice introduced 2024-07-30 20:39 UTC by Report Bug Copy Issue Report The property `formatOutput` does not exist. Although not strictly required by PHP, it is generally a best practice to declare properties explicitly. Loading history...
86			$this->signature = $signature;
87			}
88
89
90			/**
91			* Make sure the given Reference points to the original XML given.
92			*/
93			private function validateReferenceUri(Reference $reference, DOMElement $xml): void
94			{
95			if (
96			in_array(
97			$this->getSignature()->getSignedInfo()->getCanonicalizationMethod()->getAlgorithm(),
98			[
99			C::C14N_INCLUSIVE_WITH_COMMENTS,
100			C::C14N_EXCLUSIVE_WITH_COMMENTS,
101			],
102			)
103			&& !$reference->isXPointer()
104			) { // canonicalization with comments used, but reference wasn't an xpointer!
105			throw new ReferenceValidationFailedException('Invalid reference for canonicalization algorithm.');
106			}
107
108			$id = $this->getId();
109			$uri = $reference->getURI();
110
111			if (empty($uri) \|\| $uri->getValue() === '#xpointer(/)') { // same-document reference
112			Assert::true(
113			$xml->isSameNode($xml->ownerDocument->documentElement),
114			'Cannot use document reference when element is not the root of the document.',
115			ReferenceValidationFailedException::class,
116			);
117			} else { // short-name or scheme-based xpointer
118			Assert::notEmpty(
119			$id,
120			'Reference points to an element, but given element does not have an ID.',
121			ReferenceValidationFailedException::class,
122			);
123			Assert::oneOf(
124			$uri->getValue(),
125			[
126			'#' . $id->getValue(),
127			'#xpointer(id(' . $id->getValue() . '))',
128			],
129			'Reference does not point to given element.',
130			ReferenceValidationFailedException::class,
131			);
132			}
133			}
134
135
136			/**
137			* @param \SimpleSAML\XMLSecurity\XML\ds\SignedInfo $signedInfo
138			* @return \SimpleSAML\XMLSecurity\XML\SignedElementInterface
139			*/
140			private function validateReference(SignedInfo $signedInfo): SignedElementInterface
141			{
142			$xml = $this->getOriginalXML();
143			$references = $signedInfo->getReferences();
144			foreach ($references as $reference) {
145			$this->validateReferenceUri($reference, $xml);
146			}
147
148			// Clone the document so we don't mess up the original DOMDocument
149			$doc = DOMDocumentFactory::create();
150			$node = $doc->importNode($xml->ownerDocument->documentElement, true);
151			$doc->appendChild($node);
152
153			$xp = XPath::getXPath($doc);
154			$sigNode = XPath::xpQuery($doc->documentElement, 'child::ds:Signature', $xp);
155			Assert::minCount($sigNode, 1, NoSignatureFoundException::class);
156			Assert::maxCount($sigNode, 1, 'More than one signature found in object.', TooManyElementsException::class);
157
158			$doc->documentElement->removeChild($sigNode[0]);
159			$data = XML::processTransforms($reference->getTransforms(), $doc->documentElement);
			0 ignored issues – show Comprehensibility Best Practice introduced 2024-07-22 21:18 UTC by Report Bug Copy Issue Report The variable `$reference` seems to be defined by a `foreach` iteration on line `144`. Are you sure the iterator is never empty, otherwise this variable is not defined? Loading history...
160			$algo = $reference->getDigestMethod()->getAlgorithm()->getValue();
161			Assert::keyExists(
162			C::$DIGEST_ALGORITHMS,
163			$algo,
164			'Unsupported digest method "' . $algo . '"',
165			InvalidArgumentException::class,
166			);
167
168			$digest = hash(C::$DIGEST_ALGORITHMS[$algo], $data, true);
169			if (
170			hash_equals(
171			$digest,
172			base64_decode($reference->getDigestValue()->getContent()->getValue(), true),
173			) !== true
174			) {
175			throw new SignatureVerificationFailedException('Failed to verify signature.');
176			}
177
178			$verifiedXml = DOMDocumentFactory::fromString($data);
179			return static::fromXML($verifiedXml->documentElement);
180			}
181
182
183			/**
184			* Verify this element against a public key.
185			*
186			* true is returned on success, false is returned if we don't have any
187			* signature we can verify. An exception is thrown if the signature
188			* validation fails.
189			*
190			* @param \SimpleSAML\XMLSecurity\Alg\Signature\SignatureAlgorithmInterface\|null $verifier The verifier to use to
191			* verify the signature. If null, attempt to verify it with the KeyInfo information in the signature.
192			*
193			* @return \SimpleSAML\XMLSecurity\XML\SignedElementInterface The Signed element if it was verified.
194			*/
195			private function verifyInternal(SignatureAlgorithmInterface $verifier): SignedElementInterface
196			{
197			/** @var \SimpleSAML\XMLSecurity\XML\ds\Signature $this->signature */
198			$signedInfo = $this->getSignature()->getSignedInfo();
199			$c14nAlg = $signedInfo->getCanonicalizationMethod()->getAlgorithm();
200
201			// the canonicalized ds:SignedInfo element (plaintext)
202			$c14nSignedInfo = $signedInfo->canonicalize($c14nAlg->getValue());
203			$ref = $this->validateReference(
204			SignedInfo::fromXML(DOMDocumentFactory::fromString($c14nSignedInfo)->documentElement),
205			);
206
207			if (
208			$verifier?->verify(
209			$c14nSignedInfo, // the canonicalized ds:SignedInfo element (plaintext)
210			// the actual signature
211			base64_decode(strval($this->getSignature()->getSignatureValue()->getValue()), true),
212			)
213			) {
214			/*
215			* validateReference() returns an object of the same class using this trait. This means the validatingKey
216			* property is available, and we can set it on the newly created object because we are in the same class,
217			* even thought the property itself is private.
218			*/
219			$ref->validatingKey = $verifier->getKey();
			0 ignored issues – show Bug introduced 2021-07-24 16:17 UTC by Report Bug Copy Issue Report Accessing `validatingKey` on the interface `SimpleSAML\XMLSecurity\XML\SignedElementInterface` suggest that you code against a concrete implementation. How about adding an `instanceof` check? Loading history...
220			return $ref;
221			}
222			throw new SignatureVerificationFailedException('Failed to verify signature.');
223			}
224
225
226			/**
227			* Retrieve certificates that sign this element.
228			*
229			* @return \SimpleSAML\XMLSecurity\Key\KeyInterface\|null The key that successfully verified this signature.
230			*/
231			public function getVerifyingKey(): ?KeyInterface
232			{
233			return $this->validatingKey;
234			}
235
236
237			/**
238			* Whether this object is signed or not.
239			*
240			* @return bool
241			*/
242			public function isSigned(): bool
243			{
244			return $this->signature !== null;
245			}
246
247
248			/**
249			* Verify the signature in this object.
250			*
251			* If no signature is present, false is returned. If a signature is present,
252			* but cannot be verified, an exception will be thrown.
253			*
254			* @param \SimpleSAML\XMLSecurity\Alg\Signature\SignatureAlgorithmInterface\|null $verifier The verifier to use to
255			* verify the signature. If null, attempt to verify it with the KeyInfo information in the signature.
256			* @return \SimpleSAML\XMLSecurity\XML\SignedElementInterface The object processed again from its canonicalised
257			* representation verified by the signature.
258			* @throws \SimpleSAML\XMLSecurity\Exception\NoSignatureFoundException if the object is not signed.
259			* @throws \SimpleSAML\XMLSecurity\Exception\InvalidArgumentException if no key is passed and there is no KeyInfo
260			* in the signature.
261			* @throws \SimpleSAML\XMLSecurity\Exception\RuntimeException if the signature fails to verify.
262			*/
263			public function verify(?SignatureAlgorithmInterface $verifier = null): SignedElementInterface
264			{
265			if (!$this->isSigned()) {
266			throw new NoSignatureFoundException();
267			}
268
269			$keyInfo = $this->signature?->getKeyInfo();
270			$algId = $this->signature->getSignedInfo()->getSignatureMethod()->getAlgorithm();
271			if ($verifier === null && $keyInfo === null) {
272			throw new InvalidArgumentException('No key or KeyInfo available for signature verification.');
273			}
274
275			if ($verifier !== null) {
276			// verify using given key
277			// TODO: make this part of the condition, so that we support using this verifier to decrypt an encrypted key
278			Assert::eq(
279			$verifier->getAlgorithmId(),
280			$algId,
281			'Algorithm provided in key does not match algorithm used in signature.',
282			);
283
284			return $this->verifyInternal($verifier);
285			}
286
287			$factory = new SignatureAlgorithmFactory();
288			foreach ($keyInfo->getInfo() as $info) {
289			if (!$info instanceof X509Data) {
290			continue;
291			}
292
293			foreach ($info->getData() as $data) {
294			if (!$data instanceof X509Certificate) {
295			// not supported
296			continue;
297			}
298
299			// build a valid PEM for the certificate
300			$cert = sprintf(
301			"-----BEGIN CERTIFICATE-----\n%s\n-----END CERTIFICATE-----",
302			strval($data->getContent()),
303			);
304
305			$cert = new Key\X509Certificate(PEM::fromString($cert));
306			$verifier = $factory->getAlgorithm($algId->getValue(), $cert->getPublicKey());
307
308			try {
309			return $this->verifyInternal($verifier);
310			} catch (RuntimeException) {
311			// failed to verify with this certificate, try with other, if any
312			}
313			}
314			}
315			throw new SignatureVerificationFailedException('Failed to verify signature.');
316			}
317
318
319			/**
320			* @return \SimpleSAML\XML\Type\IDValue\|null
321			*/
322			abstract public function getId(): ?IDValue;
323
324
325			/**
326			* Get the list of algorithms that are blacklisted for any signing operation.
327			*
328			* @return string[]\|null An array with all algorithm identifiers that are blacklisted, or null to use this
329			* libraries default.
330			*/
331			abstract public function getBlacklistedAlgorithms(): ?array;
332			}
333

simplesamlphp / xml-security

SignedElementTrait::validateReferenceUri() A last analyzed 2025-08-12 11:32 UTC

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like

SignedElementTrait::validateReferenceUri() A
last analyzed 2025-08-12 11:32 UTC