Xmlsec1 and large file

[tettesdf]

we use xmlsec1 command in linux console and i have this error
parser error : xmlSAX2Characters: huge text node

This is because the file is larger than 10MB.

Ho i can bypass this?

[lsh123]

Which version of xmlsec are you using? This should have been fixed a couple years ago in PR #284

If you are using a new version of xmlsec, then could you please print a complete error / stack trace so I can understand why this flags are not set correctly for you.

[tettesdf]

I thank for reply.

I have this version:
Production: xmlsec1 1.2.27 (openssl)
Dev: xmlsec1 1.2.25 (openssl)

I use the command in this mode:
xmlsec1 --sign --output file_to_sign --pkcs12 pathtocert --pwd miapawd file_original
And the error is this:
/tmp/myfile:109: parser error : xmlSAX2Characters: huge text node
8d8d25D0904a5a895f3f88363f2213eTLHYb483a01fcaaa7998387cfa6354e709/378gdGrt297448
^
/tmp/myfile:109: parser error : Extra content at the end of the document
8d8d25D0904a5a895f3f88363f2213eTLHYb483a01fcaaa7998387cfa6354e709/378gdGrt297448
^
func=xmlSecParseFile:file=parser.c:line=400:obj=unknown:subj=xmlParseDocument:error=5:libxml2 library function failed:filename=/tmp/myfile; xml error: 5: Extra content at the end of the document

Error: failed to parse xml file "/tmp/myfile"
Error: failed to load template "/tmp/myfile"
Error: failed to sign file "/tmp/myfile"

Is a version problem?
If i can't update there are a solution?
From what version are supported huge file? and i can use the same line command or i must change?

Thanks

[lsh123]

The 1.2.27 is 4.5 years old, yes upgrading to the latest release 1.2.37 should fix the problem. If you can't update, then you can try to apply the PR I mentioned above manually but I have no idea if it would apply cleanly or not.

The huge files support was added in 1.2.30 (see news) but I highly recommend updating to the latest one. There are other bug fixes that might help you as well. And the command line should not change, the interfaces have been very stable for the last 20 years though I am going to change things a little bit in the upcoming 1.3.0 release this April :)

[tettesdf]

Thanks, you are the best!

[tettesdf]

there is the statically compiled version somewhere?

and is it possible to compile it statically, is there anything to be careful about?

[lsh123]

I don't offer binaries, only source code. xmlsec is included in most of the major Linux distros. On Windows, it is more involved but you can see how to do it in the Github CI for example:

https://github.com/lsh123/xmlsec/blob/master/.github/workflows/make-check.yml

[lsh123]

BTW, I forgot to mention -- if you are processing huge files then you likely will benefit from increasing the chunk size here:

https://github.com/lsh123/xmlsec/blob/xmlsec-1_2_x/include/xmlsec/transforms.h#L41

it's hard coded at 1K and you can bump it to 256K or even higher. This should improve performance in a big way for you (in expense of higher memory usage). On the master, there is a way to change this dynamically and it will be in the next release. But this is one of the changes that breaks ABI compatibility that I didn't want to do for a while :) However local change to the #define should be very safe thing to do.