Closed
Description
Description
SignedXml.CheckSignature is returning false for valid a enveloped signature document that is using a <ds:References URI="#xpointer(/)">.
This should work, given that xpointer(/) is explicitly mentioned in the documentation, and SignedXml code
Reproduction Steps
var xmlDoc = new XmlDocument();
xmlDoc.LoadXml("""<?xml version="1.0" encoding="UTF-8"?><hello><world>Hi</world><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments" /><SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" /><Reference URI="#xpointer(/)"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments" /></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /><DigestValue>SVaCE5w9iLXTVYTKP1t/yjjmPXvWovMYpgljGgpgz2Y=</DigestValue></Reference></SignedInfo><SignatureValue>dqcBmS1ZvDJNhmCEgobpAb+A2XaiuB69dfGIhisZvqoxaWqAqv/0w49jp38+usJ5t3wcq3aMC631QE8iln+lHWrarojDMDWLa00isv3oE3q9UgOIV9e6MUSoRTTvQkmlK/LSYV9T/SKx6h03vLLcIkUMXaTkC/n2kthlJTGkLbU=</SignatureValue><KeyInfo><KeyValue><RSAKeyValue><Modulus>t6qV1iTlkCPoaIeOTvnDczQv5pytUxMoyNXws5vaMQYxfJMKos47dvmiLtfWUDLYXFX3Yf/JMC14plJw2JA5jLrlHLnZj/vCjRtXckmWW/wGYewXUqrgR1CytStUeQKj9mNsi76erukua10UhzIrWG+H6YQ/qS4AMMJZU6jBvO0=</Modulus><Exponent>AQAB</Exponent></RSAKeyValue></KeyValue></KeyInfo></Signature></hello>""");
var signedXml = new SignedXml(xmlDoc);
var signature = xmlDoc.GetElementsByTagName("Signature", SignedXml.XmlDsigNamespaceUrl).OfType<XmlElement>().Single();
signedXml.LoadXml(signature);
var result = signedXml.CheckSignature();Expected behavior
SignedXml.CheckSignature returns true
Actual behavior
SignedXml.CheckSignature returns false
Regression?
This issue started happening between v7.0.0-preview.3.22175.4 and v7.0.0-preview.4.22229.4
Known Workarounds
No response
Configuration
No response
Other information
I wrote a small app for reproducing and narrowing down the regression here: https://github.com/m0sa/EnvelopedXMLDSIG
I get the following output:
$ dotnet run -p:NugetVersion=7.0.0-preview.4.22229.4 -f net6.0 -c Debug --project .\Verifier\Verifier.csproj -- exampleSigned.xml exampleKey.pem
signedXml.CheckSignature(/* */): FAIL (System.Security.Cryptography.Xml: 7.0.0-preview.4.22229.4+9c37a3b3eb6d955d54865a2f9edf557620ab7fa8, .NET: 6.0.25)
signedXml.CheckSignature(rsaKey): FAIL (System.Security.Cryptography.Xml: 7.0.0-preview.4.22229.4+9c37a3b3eb6d955d54865a2f9edf557620ab7fa8, .NET: 6.0.25)
$ dotnet run -p:NugetVersion=7.0.0-preview.3.22175.4 -f net6.0 -c Debug --project .\Verifier\Verifier.csproj -- exampleSigned.xml exampleKey.pem
signedXml.CheckSignature(/* */): PASS (System.Security.Cryptography.Xml: 7.0.0-preview.3.22175.4+162f83657cab981e82dbae0ed89b2bc5b44c2d86, .NET: 6.0.25)
signedXml.CheckSignature(rsaKey): PASS (System.Security.Cryptography.Xml: 7.0.0-preview.3.22175.4+162f83657cab981e82dbae0ed89b2bc5b44c2d86, .NET: 6.0.25)
I did some debugging and it seems to boil down to the XmlDsigEnvelopedSignatureTransform.SignaturePosition not getting set here