[SANTUARIO-273] xml:base attribute not processed correctly in C14N11 canonicalization

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Java 1.4.4
• Fix Version/s: Java 1.4.6, Java 1.5
• Component/s: Java
• Security Level: Public (Public issues, viewable by everyone)
• Labels: c14n11
• Environment: Windows 7 Professional
• Assignee: Colm O hEigeartaigh
• Reporter: Daniel Granath
• Created: 19/May/11 10:08
• Updated: 21/Oct/11 12:25
• Resolved: 16/Jul/11 18:10

Description

In version 1.4.4 it seems that the xml:base attribute is not processed correctly. I have modified the input in the sample org.apache.xml.security.samples.canonicalization.CanonSubTree to make it look like this:

<?xml version="1.0" encoding="UTF-8"?>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#"
xml:base="http://www.acme.com/resources/">
<SignedInfo xml:base="subresources/"><!-- comment inside -->
<CanonicalizationMethod
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" />
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"
/>
<Reference URI="http://www.w3.org/TR/xml-stylesheet">
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>60NvZvtdTB+7UnlLp/H24p7h4bs=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>
fKMmy9GYF2s8rLFrZdVugTOFuWx19ccX7jh5HqFd4vMOY7LWAj52ykjSdvtW3fNY
PPYGC4MFL19oPSId5GEsMtFMpGXB3XaCtoKjMCHQsN3+kom8YnGf7Ge1JNRcGty5
0UsoP6Asj47+QR7QECT64uoziha4WRDVyXjDrg24W+U=
</SignatureValue>
<KeyInfo>
<KeyName>Lugh</KeyName>
</KeyInfo>
</Signature>

The only changes are the xml:base attributes on the Signature and SignedInfo elements. The other change I've made is to use c14n11 (http://www.w3.org/2006/12/xml-c14n11).
The output from the sample is:

<SignedInfo xmlns="http://www.w3.org/2000/09/xmldsig#"
xml:base="subresources/">
<CanonicalizationMethod
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"></CanonicalizationMethod>
<SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"></SignatureMethod>
<Reference URI="http://www.w3.org/TR/xml-stylesheet">
<DigestMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></DigestMethod>
<DigestValue>60NvZvtdTB+7UnlLp/H24p7h4bs=</DigestValue>
</Reference>
</SignedInfo>

I would have expected the xml:base attribute to get the value
"http://www.acme.com/resources/subresources/".
I have also tested this against the latest source in the 1.4.x-fixes branch
with the same result.