akami 1.3.2 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 20bb54b460119624acb0737c62c1c0b82825ace9886a239e2a3cefd8461635c7
-  data.tar.gz: c5fb01bbaf55b70be8627e2f9ee6a40cd2e6680ee2b0cee65d38eedd78961a48
+  metadata.gz: 184a02f0bc62b95abd62b455fcd57dd5ffdf8c7d88a89b0651f8edb566fab1db
+  data.tar.gz: 39adab6b78b3a9346ce22b9bc3981e13f3bc67637fbc75276a48d6e0b0f9d0c9
 SHA512:
-  metadata.gz: 787c578411ef161d8109708b1d498743b9bf7a24e840566209f946179b9ffe4ce0d20ce2236a615973108ffb578423bad481cc0d11301ee4617762d19cc24308
-  data.tar.gz: 6a421ce03eda89cf332b767e76d2c89dbd5577ecc36dc08d4d696f3ee8e1f84a6160bfd4fdba32f6bd30d3aaacc62cb3f7d07e7c0b7363bce389a198455a7a8e
+  metadata.gz: 9151cd717f8bcae3f2c7552cf8660bb005a32406011c7c4e126f98cfe8e8971d7c21ee46e89fde9c4a39f156c1dac7dfecd636c84e44872343d72de8c0eae511
+  data.tar.gz: 570ced037808a33bf36843ebf378922a6bdb2e074781391831fe85bc1129c5b201e8114011ea5f511c3addaeb7e4f52e7cfc89ab4ef35271b494fb63ab7dbeae

data/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 1.4.0 (2026-09-16)
+
+* Feature: [#47](https://github.com/savonrb/akami/pull/47) Support signed WS-Security timestamps. `Signature.new` accepts a `timestamp: true` option (plus optional `created_at`/`expires_at`) that adds a `wsu:Timestamp` to the Security header and covers it with its own digest Reference, so the timestamp cannot be altered without invalidating the signature.
+* Feature: [#46](https://github.com/savonrb/akami/pull/46) Handle InclusiveNamespaces configuration when verifying signatures.
+* Fix: [#62](https://github.com/savonrb/akami/pull/62) Fix signature verification for multi-token documents and signed attachments. The signer's certificate is now selected via the `SecurityTokenReference` instead of always taking the first `BinarySecurityToken`, and `cid:` attachment references can be verified against caller-supplied `decrypted_attachments`.
+
+## 1.3.3 (2024-02-13)
+
+* Explicitly declare base64 dep in gemfile (useful for testing against ruby-head).
+
 ## 1.3.2 (2024-01-09)
 
 * Stop patching Hash [#35](https://github.com/savonrb/akami/pull/35)
@@ -28,3 +38,4 @@
 ## 1.0.0 (2011-07-03)
 
 * Initial version extracted from the [Savon](http://rubygems.org/gems/savon) library.
+

data/lib/akami/c14n_helper.rb

@@ -1,8 +1,8 @@
 module Akami
   module C14nHelper
-    def canonicalize(xml)
+    def canonicalize(xml, inclusive_namespaces = nil)
       return unless xml
-      xml.canonicalize Nokogiri::XML::XML_C14N_EXCLUSIVE_1_0
+      xml.canonicalize Nokogiri::XML::XML_C14N_EXCLUSIVE_1_0, inclusive_namespaces
     end
   end
 end

data/lib/akami/hash_helper.rb

@@ -3,9 +3,9 @@ module Akami
     # Returns a new Hash with +hash+ and +other_hash+ merged recursively.
     # Modifies +hash+ in place.
     def self.deep_merge!(hash, other_hash)
-      other_hash.each_pair do |k,v|
+      other_hash.each_pair do |k, v|
         tv = hash[k]
-        hash[k] = tv.is_a?(Hash) && v.is_a?(Hash) ? deep_merge!(tv.dup, v) : v
+        hash[k] = (tv.is_a?(Hash) && v.is_a?(Hash)) ? deep_merge!(tv.dup, v) : v
       end
       hash
     end

data/lib/akami/version.rb

@@ -1,5 +1,3 @@
 module Akami
-
-  VERSION = '1.3.2'
-
+  VERSION = "1.4.0"
 end

data/lib/akami/wsse/certs.rb

@@ -2,10 +2,9 @@ module Akami
   class WSSE
     # Contains certs for WSSE::Signature
     class Certs
-
       def initialize(certs = {})
         certs.each do |key, value|
-          self.send :"#{key}=", value
+          send :"#{key}=", value
         end
       end
 

data/lib/akami/wsse/signature.rb

@@ -12,6 +12,9 @@ module Akami
       # For a +Savon::WSSE::Certs+ object. To hold the certs we need to sign.
       attr_accessor :certs
 
+      # Wheater to sign the timestamp or not ant their time
+      attr_accessor :timestamp, :created_at, :expires_at
+
       # Without a document, the document cannot be signed.
       # Generate the document once, and then set document and recall #to_token
       def document
@@ -23,17 +26,20 @@ module Akami
         @document = Nokogiri::XML(document)
       end
 
-      ExclusiveXMLCanonicalizationAlgorithm = 'http://www.w3.org/2001/10/xml-exc-c14n#'.freeze
-      RSASHA1SignatureAlgorithm = 'http://www.w3.org/2000/09/xmldsig#rsa-sha1'.freeze
-      SHA1DigestAlgorithm = 'http://www.w3.org/2000/09/xmldsig#sha1'.freeze
+      ExclusiveXMLCanonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#".freeze
+      RSASHA1SignatureAlgorithm = "http://www.w3.org/2000/09/xmldsig#rsa-sha1".freeze
+      SHA1DigestAlgorithm = "http://www.w3.org/2000/09/xmldsig#sha1".freeze
 
-      X509v3ValueType = 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3'.freeze
-      Base64EncodingType = 'http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary'.freeze
+      X509v3ValueType = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3".freeze
+      Base64EncodingType = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary".freeze
 
-      SignatureNamespace = 'http://www.w3.org/2000/09/xmldsig#'.freeze
+      SignatureNamespace = "http://www.w3.org/2000/09/xmldsig#".freeze
 
-      def initialize(certs = Certs.new)
+      def initialize(certs = Certs.new, options = {})
         @certs = certs
+        @timestamp = options[:timestamp] || false
+        @created_at = options[:created_at]
+        @expires_at = options[:expires_at]
       end
 
       def have_document?
@@ -50,6 +56,26 @@ module Akami
         @body_id ||= "Body-#{uid}".freeze
       end
 
+      def timestamp_id
+        @timestamp_id ||= "TS-#{uid}".freeze
+      end
+
+      def wsu_timestamp_hash
+        return {} unless timestamp
+        {
+          "wsu:Timestamp" => {
+            "wsu:Created" => (@created_at ||= Time.now).utc.xmlschema,
+            "wsu:Expires" => (@expires_at ||= created_at + 60).utc.xmlschema
+          },
+          :attributes! => {
+            "wsu:Timestamp" => {
+              "wsu:Id" => timestamp_id,
+              "xmlns:wsu" => WSU_NAMESPACE
+            }
+          }
+        }
+      end
+
       def security_token_id
         @security_token_id ||= "SecurityToken-#{uid}".freeze
       end
@@ -57,7 +83,14 @@ module Akami
       def body_attributes
         {
           "xmlns:wsu" => Akami::WSSE::WSU_NAMESPACE,
-          "wsu:Id" => body_id,
+          "wsu:Id" => body_id
+        }
+      end
+
+      def timestamp_attributes
+        {
+          "xmlns:wsu" => Akami::WSSE::WSU_NAMESPACE,
+          "wsu:Id" => timestamp_id
         }
       end
 
@@ -65,20 +98,20 @@ module Akami
         return {} unless have_document?
 
         sig = signed_info.merge(key_info).merge(signature_value)
-        sig.merge! :order! => []
-        [ "SignedInfo", "SignatureValue", "KeyInfo" ].each do |key|
+        sig[:order!] = []
+        ["SignedInfo", "SignatureValue", "KeyInfo"].each do |key|
           sig[:order!] << key if sig[key]
         end
 
         token = {
           "Signature" => sig,
-          :attributes! => { "Signature" => { "xmlns" => SignatureNamespace } },
+          :attributes! => {"Signature" => {"xmlns" => SignatureNamespace}}
         }
 
         Akami::HashHelper.deep_merge!(token, binary_security_token) if certs.cert
 
-        token.merge! :order! => []
-        [ "wsse:BinarySecurityToken", "Signature" ].each do |key|
+        token[:order!] = []
+        ["wsse:BinarySecurityToken", "Signature"].each do |key|
           token[:order!] << key if token[key]
         end
 
@@ -89,13 +122,13 @@ module Akami
 
       def binary_security_token
         {
-          "wsse:BinarySecurityToken" => Base64.encode64(certs.cert.to_der).gsub("\n", ''),
-          :attributes! => { "wsse:BinarySecurityToken" => {
+          "wsse:BinarySecurityToken" => Base64.encode64(certs.cert.to_der).delete("\n"),
+          :attributes! => {"wsse:BinarySecurityToken" => {
             "wsu:Id" => security_token_id,
-            'EncodingType' => Base64EncodingType,
-            'ValueType' => X509v3ValueType,
-            "xmlns:wsu" => Akami::WSSE::WSU_NAMESPACE,
-          } }
+            "EncodingType" => Base64EncodingType,
+            "ValueType" => X509v3ValueType,
+            "xmlns:wsu" => Akami::WSSE::WSU_NAMESPACE
+          }}
         }
       end
 
@@ -104,18 +137,18 @@ module Akami
           "KeyInfo" => {
             "wsse:SecurityTokenReference" => {
               "wsse:Reference/" => nil,
-              :attributes! => { "wsse:Reference/" => {
+              :attributes! => {"wsse:Reference/" => {
                 "ValueType" => X509v3ValueType,
-                "URI" => "##{security_token_id}",
-              } }
+                "URI" => "##{security_token_id}"
+              }}
             },
-            :attributes! => { "wsse:SecurityTokenReference" => { "xmlns:wsu" => "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" } },
-          },
+            :attributes! => {"wsse:SecurityTokenReference" => {"xmlns:wsu" => "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"}}
+          }
         }
       end
 
       def signature_value
-        { "SignatureValue" => the_signature }
+        {"SignatureValue" => the_signature}
       rescue MissingCertificate
         {}
       end
@@ -125,26 +158,35 @@ module Akami
           "SignedInfo" => {
             "CanonicalizationMethod/" => nil,
             "SignatureMethod/" => nil,
-            "Reference" => [
-              #signed_info_transforms.merge(signed_info_digest_method).merge({ "DigestValue" => timestamp_digest }),
-              signed_info_transforms.merge(signed_info_digest_method).merge({ "DigestValue" => body_digest }),
-            ],
+            "Reference" => references,
             :attributes! => {
-              "CanonicalizationMethod/" => { "Algorithm" => ExclusiveXMLCanonicalizationAlgorithm },
-              "SignatureMethod/" => { "Algorithm" => RSASHA1SignatureAlgorithm },
-              "Reference" => { "URI" => ["##{body_id}"] },
+              "CanonicalizationMethod/" => {"Algorithm" => ExclusiveXMLCanonicalizationAlgorithm},
+              "SignatureMethod/" => {"Algorithm" => RSASHA1SignatureAlgorithm},
+              "Reference" => {"URI" => reference_uris}
             },
-            :order! => [ "CanonicalizationMethod/", "SignatureMethod/", "Reference" ],
-          },
+            :order! => ["CanonicalizationMethod/", "SignatureMethod/", "Reference"]
+          }
         }
       end
 
+      def references
+        ref = [signed_info_transforms.merge(signed_info_digest_method).merge({"DigestValue" => body_digest})]
+        ref << signed_info_transforms.merge(signed_info_digest_method).merge({"DigestValue" => timestamp_digest}) if timestamp
+        ref
+      end
+
+      def reference_uris
+        ref_uris = ["##{body_id}"]
+        ref_uris << "##{timestamp_id}" if timestamp
+        ref_uris
+      end
+
       def the_signature
         raise MissingCertificate, "Expected a private_key for signing" unless certs.private_key
         signed_info = at_xpath(@document, "//Envelope/Header/Security/Signature/SignedInfo")
         signed_info = signed_info ? canonicalize(signed_info) : ""
-        signature = certs.private_key.sign(OpenSSL::Digest::SHA1.new, signed_info)
-        Base64.encode64(signature).gsub("\n", '') # TODO: DRY calls to Base64.encode64(...).gsub("\n", '')
+        signature = certs.private_key.sign(OpenSSL::Digest.new("SHA1"), signed_info)
+        Base64.encode64(signature).delete("\n") # TODO: DRY calls to Base64.encode64(...).gsub("\n", '')
       end
 
       def body_digest
@@ -152,16 +194,23 @@ module Akami
         Base64.encode64(OpenSSL::Digest::SHA1.digest(body)).strip
       end
 
+      def timestamp_digest
+        return nil unless timestamp
+
+        canonical_timestamp = canonicalize(at_xpath(@document, "//Envelope/Header/Security/Timestamp"))
+        Base64.encode64(OpenSSL::Digest::SHA1.digest(canonical_timestamp)).strip if canonical_timestamp
+      end
+
       def signed_info_digest_method
-        { "DigestMethod/" => nil, :attributes! => { "DigestMethod/" => { "Algorithm" => SHA1DigestAlgorithm } } }
+        {"DigestMethod/" => nil, :attributes! => {"DigestMethod/" => {"Algorithm" => SHA1DigestAlgorithm}}}
       end
 
       def signed_info_transforms
-        { "Transforms" => { "Transform/" => nil, :attributes! => { "Transform/" => { "Algorithm" => ExclusiveXMLCanonicalizationAlgorithm } } } }
+        {"Transforms" => {"Transform/" => nil, :attributes! => {"Transform/" => {"Algorithm" => ExclusiveXMLCanonicalizationAlgorithm}}}}
       end
 
       def uid
-        OpenSSL::Digest::SHA1.hexdigest([Time.now, rand].collect(&:to_s).join('/'))
+        OpenSSL::Digest::SHA1.hexdigest([Time.now, rand].join("/"))
       end
     end
   end

data/lib/akami/wsse/verify_signature.rb

@@ -1,5 +1,5 @@
-require 'nokogiri'
-require 'openssl'
+require "nokogiri"
+require "openssl"
 
 module Akami
   class WSSE
@@ -11,19 +11,27 @@ module Akami
 
       class InvalidDigest < RuntimeError; end
       class InvalidSignedValue < RuntimeError; end
+      class MissingDecryptedAttachment < RuntimeError; end
 
       attr_reader :document
 
-      def initialize(xml)
+      # @param xml [String] The XML document to verify
+      # @param decrypted_attachments [Hash] A hash of decrypted attachments: { 'id' => 'decrypted_string' }
+      # For example: the decrypted_attachments of a gzipped xml is the gzipped base64 string, the result of the decryption
+      # { 'phase4-att-1f34-4d68a..' => 'kZ\xB4\xCD}\xCB..' }
+      def initialize(xml, decrypted_attachments: {})
         @document = Nokogiri::XML(xml.to_s, &:noblanks)
+        @decrypted_attachments = decrypted_attachments
       end
 
       # Returns XML namespaces that are used internally for document querying.
       def namespaces
         @namespaces ||= {
           wse: Akami::WSSE::WSE_NAMESPACE,
-          ds:  'http://www.w3.org/2000/09/xmldsig#',
+          wsse: Akami::WSSE::WSE_NAMESPACE,
+          ds: "http://www.w3.org/2000/09/xmldsig#",
           wsu: Akami::WSSE::WSU_NAMESPACE,
+          ec: Akami::WSSE::Signature::ExclusiveXMLCanonicalizationAlgorithm
         }
       end
 
@@ -32,21 +40,31 @@ module Akami
 
       # Returns signer's certificate, bundled in signed document
       def certificate
-        certificate_value = document.at_xpath('//wse:Security/wse:BinarySecurityToken', namespaces).text.strip
-        OpenSSL::X509::Certificate.new Base64.decode64(certificate_value)
+        binary_security_tokens = document.xpath("//wse:Security/wse:BinarySecurityToken", namespaces)
+        if binary_security_tokens.size > 1
+          signature_certificate_id = document.at_xpath(
+            "//wse:Security/ds:Signature/ds:KeyInfo/wsse:SecurityTokenReference/wsse:Reference",
+            namespaces
+          )["URI"][1..] # strip leading '#'
+          certificate_value = document.at_xpath("//wse:Security/wse:BinarySecurityToken[@wsu:Id=\"#{signature_certificate_id}\"]", namespaces)
+        else
+          certificate_value = binary_security_tokens.first
+        end
+
+        OpenSSL::X509::Certificate.new Base64.decode64(certificate_value.text.strip)
       end
 
       # Validates document signature, returns +true+ on success, +false+ otherwise.
       def valid?
         verify
-      rescue InvalidDigest, InvalidSignedValue
-        return false
+      rescue InvalidDigest, InvalidSignedValue, MissingDecryptedAttachment
+        false
       end
 
       # Validates document signature and digests and raises if anything mismatches.
       def verify!
         verify
-      rescue InvalidDigest, InvalidSignedValue => e
+      rescue InvalidDigest, InvalidSignedValue, MissingDecryptedAttachment => e
         raise InvalidSignature, e.message
       end
 
@@ -58,55 +76,68 @@ module Akami
       #
       #   digesters['http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'] = OpenSSL::Digest::SHA512.new
 
-      def digesters
-        @digesters
-      end
+      attr_reader :digesters
 
       private
 
       def verify
-        document.xpath('//wse:Security/ds:Signature/ds:SignedInfo/ds:Reference', namespaces).each do |ref|
-          digest_algorithm = ref.at_xpath('//ds:DigestMethod', namespaces)['Algorithm']
-          element_id = ref.attributes['URI'].value[1..-1] # strip leading '#'
-          element = document.at_xpath(%(//*[@wsu:Id="#{element_id}"]), namespaces)
-          unless supplied_digest(element) == generate_digest(element, digest_algorithm)
+        document.xpath("//wse:Security/ds:Signature/ds:SignedInfo/ds:Reference", namespaces).each do |ref|
+          digest_algorithm = ref.at_xpath("//ds:DigestMethod", namespaces)["Algorithm"]
+
+          transform_inclusive_ns = inclusive_namespaces(ref, ".//ds:Transforms/ds:Transform/ec:InclusiveNamespaces")
+
+          ref_uri = ref.attributes["URI"].value
+          if ref_uri.start_with?("#")
+            element_id = ref_uri.sub(/^#/, "")
+            element = document.at_xpath(%(//*[@wsu:Id="#{element_id}"]), namespaces)
+            generated_digest = generate_digest(element, digest_algorithm, transform_inclusive_ns)
+          else
+            element_id = ref_uri.sub(/^cid:/, "")
+            element = @decrypted_attachments[element_id]
+            raise MissingDecryptedAttachment, "Missing decrypted attachment for #{element_id}" if element.nil?
+            generated_digest = digest(element, digest_algorithm).strip
+          end
+
+          unless supplied_digest(ref) == generated_digest
             raise InvalidDigest, "Invalid Digest for #{element_id}"
           end
         end
 
-        data = canonicalize(signed_info)
+        canonicalization_inclusive_ns = inclusive_namespaces(document, "//ds:CanonicalizationMethod/ec:InclusiveNamespaces")
+
+        data = canonicalize(signed_info, canonicalization_inclusive_ns)
         signature = Base64.decode64(signature_value)
-        signature_algorithm = document.at_xpath('//wse:Security/ds:Signature/ds:SignedInfo/ds:SignatureMethod', namespaces)['Algorithm']
+        signature_algorithm = document.at_xpath("//wse:Security/ds:Signature/ds:SignedInfo/ds:SignatureMethod", namespaces)["Algorithm"]
         signature_digester = digester_for_signature_method(signature_algorithm)
 
         certificate.public_key.verify(signature_digester, signature, data) or raise InvalidSignedValue, "Could not verify the signature value"
       end
 
+      def inclusive_namespaces(ref, xpath)
+        inclusive_namespaces_element = ref.at_xpath(xpath, namespaces)
+        inclusive_namespaces_element["PrefixList"].split if inclusive_namespaces_element
+      end
+
       def signed_info
-        document.at_xpath('//wse:Security/ds:Signature/ds:SignedInfo', namespaces)
+        document.at_xpath("//wse:Security/ds:Signature/ds:SignedInfo", namespaces)
       end
 
       # Generate digest for a given +element+ (or its XPath) with a given +algorithm+
-      def generate_digest(element, algorithm)
+      def generate_digest(element, algorithm, inclusive_namespaces = nil)
         element = document.at_xpath(element, namespaces) if element.is_a? String
-        xml = canonicalize(element)
+        xml = canonicalize(element, inclusive_namespaces)
         digest(xml, algorithm).strip
       end
 
       def supplied_digest(element)
-        element = document.at_xpath(element, namespaces) if element.is_a? String
-        find_digest_value element.attributes['Id'].value
+        element.at_xpath(".//ds:DigestValue", namespaces).text
       end
 
       def signature_value
-        element = document.at_xpath('//wse:Security/ds:Signature/ds:SignatureValue', namespaces)
+        element = document.at_xpath("//wse:Security/ds:Signature/ds:SignatureValue", namespaces)
         element ? element.text : ""
       end
 
-      def find_digest_value(id)
-        document.at_xpath(%(//wse:Security/ds:Signature/ds:SignedInfo/ds:Reference[@URI="##{id}"]/ds:DigestValue), namespaces).text
-      end
-
       # Calculate digest for string with given algorithm URL and Base64 encodes it.
       def digest(string, algorithm)
         Base64.encode64 digester(algorithm).digest(string)
@@ -115,8 +146,8 @@ module Akami
       # Returns digester for calculating digest for signature verification
       def digester_for_signature_method(algorithm_url)
         signature_digest_mapping = {
-          'http://www.w3.org/2000/09/xmldsig#rsa-sha1' => 'http://www.w3.org/2000/09/xmldsig#sha1',
-          'http://www.w3.org/2001/04/xmldsig-more#gostr34102001-gostr3411' => 'http://www.w3.org/2001/04/xmldsig-more#gostr3411',
+          "http://www.w3.org/2000/09/xmldsig#rsa-sha1" => "http://www.w3.org/2000/09/xmldsig#sha1",
+          "http://www.w3.org/2001/04/xmldsig-more#gostr34102001-gostr3411" => "http://www.w3.org/2001/04/xmldsig-more#gostr3411"
         }
         digest_url = signature_digest_mapping[algorithm_url] || algorithm_url
         digester(digest_url)
@@ -124,23 +155,24 @@ module Akami
 
       # Constructors for known digest calculating objects
       DIGESTERS = {
-          # SHA1
-          'http://www.w3.org/2000/09/xmldsig#sha1' => lambda { OpenSSL::Digest::SHA1.new },
-          # SHA 256
-          'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' => lambda { OpenSSL::Digest::SHA256.new },
-          # GOST R 34.11-94
-          # You need correctly configured gost engine in your system OpenSSL, requires OpenSSL >= 1.0.0
-          # see https://github.com/openssl/openssl/blob/master/engines/ccgost/README.gost
-          'http://www.w3.org/2001/04/xmldsig-more#gostr3411' => lambda {
-            if defined? JRUBY_VERSION
-              OpenSSL::Digest.new('GOST3411')
-            else
-              OpenSSL::Engine.load
-              gost_engine = OpenSSL::Engine.by_id('gost')
-              gost_engine.set_default(0xFFFF)
-              gost_engine.digest('md_gost94')
-            end
-          },
+        # SHA1
+        "http://www.w3.org/2000/09/xmldsig#sha1" => lambda { OpenSSL::Digest.new("SHA1") },
+        # SHA 256
+        "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" => lambda { OpenSSL::Digest.new("SHA256") },
+        "http://www.w3.org/2001/04/xmlenc#sha256" => lambda { OpenSSL::Digest.new("SHA256") },
+        # GOST R 34.11-94
+        # You need correctly configured gost engine in your system OpenSSL, requires OpenSSL >= 1.0.0
+        # see https://github.com/openssl/openssl/blob/master/engines/ccgost/README.gost
+        "http://www.w3.org/2001/04/xmldsig-more#gostr3411" => lambda {
+          if defined? JRUBY_VERSION
+            OpenSSL::Digest.new("GOST3411")
+          else
+            OpenSSL::Engine.load
+            gost_engine = OpenSSL::Engine.by_id("gost")
+            gost_engine.set_default(0xFFFF)
+            gost_engine.digest("md_gost94")
+          end
+        }
       }
 
       # Returns instance of +OpenSSL::Digest+ class, initialized, reset, and ready to calculate new hashes.
@@ -152,7 +184,6 @@ module Akami
         end
         @digesters[url].reset
       end
-
     end
   end
 end

data/lib/akami/wsse.rb

@@ -9,12 +9,10 @@ require "akami/wsse/verify_signature"
 require "akami/wsse/signature"
 
 module Akami
-
   # = Akami::WSSE
   #
   # Building Web Service Security.
   class WSSE
-
     # Namespace for WS Security Secext.
     WSE_NAMESPACE = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
 
@@ -90,24 +88,23 @@ module Akami
 
     # Returns the XML for a WSSE header.
     def to_xml
-      if signature? and signature.have_document?
-        Gyoku.xml wsse_signature.merge!(hash)
-      elsif username_token? && timestamp?
-        Gyoku.xml wsse_username_token.merge!(wsu_timestamp) {
-          |key, v1, v2| v1.merge!(v2) {
-            |key, v1, v2| v1.merge!(v2)
-          }
-        }
-      elsif username_token?
-        Gyoku.xml wsse_username_token.merge!(hash)
-      elsif timestamp?
-        Gyoku.xml wsu_timestamp.merge!(hash)
-      else
-        ""
-      end
+      h = wsse_signature if signature? && signature.have_document?
+      h = merge_hashes_with_keys(h, wsu_timestamp) if timestamp?
+      h = merge_hashes_with_keys(h, wsse_username_token) if username_token?
+
+      return "" unless h
+      Gyoku.xml h
     end
 
-  private
+    private
+
+    def merge_hashes_with_keys(hash_one, hash_two)
+      return hash_two unless hash_one
+      keys = hash_one["wsse:Security"][:order!] | hash_two["wsse:Security"][:order!]
+      Akami::HashHelper.deep_merge!(hash_one, hash_two)
+      hash_one["wsse:Security"][:order!] = keys
+      hash_one
+    end
 
     # Returns a Hash containing wsse:UsernameToken details.
     def wsse_username_token
@@ -117,14 +114,14 @@ module Akami
           "wsse:Nonce" => Base64.encode64(nonce).chomp,
           "wsu:Created" => timestamp,
           "wsse:Password" => digest_password,
-          :attributes! => { "wsse:Password" => { "Type" => PASSWORD_DIGEST_URI },  "wsse:Nonce" => { "EncodingType" => BASE64_URI } }
+          :attributes! => {"wsse:Password" => {"Type" => PASSWORD_DIGEST_URI}, "wsse:Nonce" => {"EncodingType" => BASE64_URI}}
         # clear the nonce after each use
         @nonce = nil
       else
         token = security_hash :wsse, "UsernameToken",
           "wsse:Username" => username,
           "wsse:Password" => password,
-          :attributes! => { "wsse:Password" => { "Type" => PASSWORD_TEXT_URI } }
+          :attributes! => {"wsse:Password" => {"Type" => PASSWORD_TEXT_URI}}
       end
       token
     end
@@ -135,7 +132,15 @@ module Akami
       # First key/value is tag/hash
       tag, hash = signature_hash.shift
 
-      security_hash nil, tag, hash, signature_hash
+      sig = security_hash nil, tag, hash, signature_hash, true
+      if signature.timestamp
+        wsu_timestamp_hash = signature.wsu_timestamp_hash
+        sig["wsse:Security"]["wsu:Timestamp"] = wsu_timestamp_hash["wsu:Timestamp"] # attributes should be merged and not overridden
+        sig["wsse:Security"][:attributes!].merge!(wsu_timestamp_hash[:attributes!])
+        sig["wsse:Security"][:order!] << "wsu:Timestamp"
+      end
+
+      sig
     end
 
     # Returns a Hash containing wsu:Timestamp details.
@@ -147,24 +152,23 @@ module Akami
 
     # Returns a Hash containing wsse/wsu Security details for a given
     # +namespace+, +tag+ and +hash+.
-    def security_hash(namespace, tag, hash, extra_info = {})
+    def security_hash(namespace, tag, hash, extra_info = {}, signature_request = false)
       key = [namespace, tag].compact.join(":")
 
       sec_hash = {
         "wsse:Security" => {
-          key => hash
+          key => hash,
+          :order! => [key]
         },
-        :attributes! => { "wsse:Security" => { "xmlns:wsse" => WSE_NAMESPACE } }
+        :attributes! => {"wsse:Security" => {"xmlns:wsse" => WSE_NAMESPACE}}
       }
 
-      unless extra_info.empty?
-        sec_hash["wsse:Security"].merge!(extra_info)
-      end
+      sec_hash["wsse:Security"].merge!(extra_info) unless extra_info.empty?
 
-      if signature?
-        sec_hash[:attributes!].merge!("soapenv:mustUnderstand" => "1")
+      if signature_request
+        sec_hash[:attributes!]["soapenv:mustUnderstand"] = "1"
       else
-        sec_hash["wsse:Security"].merge!(:attributes! => { key => { "wsu:Id" => "#{tag}-#{count}", "xmlns:wsu" => WSU_NAMESPACE } })
+        sec_hash["wsse:Security"][:attributes!] = {key => {"wsu:Id" => "#{tag}-#{count}", "xmlns:wsu" => WSU_NAMESPACE}}
       end
 
       sec_hash
@@ -201,6 +205,5 @@ module Akami
     def hash
       @hash ||= Hash.new { |h, k| h[k] = Hash.new(&h.default_proc) }
     end
-
   end
 end

data/lib/akami/xpath_helper.rb

@@ -11,7 +11,7 @@ module Akami
     end
 
     def local_name_xpath(xpath)
-      xpath.gsub(%r{([/]*)([A-Za-z]+)([/]*)}) { "#{$1}*[local-name()='#{$2}']#{$3}" }
+      xpath.gsub(%r{(/*)([A-Za-z]+)(/*)}) { "#{$1}*[local-name()='#{$2}']#{$3}" }
     end
   end
 end

data/lib/akami.rb

@@ -2,10 +2,8 @@ require "akami/version"
 require "akami/wsse"
 
 module Akami
-
   # Returns a new <tt>Akami::WSSE</tt>.
   def self.wsse
     WSSE.new
   end
-
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: akami
 version: !ruby/object:Gem::Version
-  version: 1.3.2
+  version: 1.4.0
 platform: ruby
 authors:
 - Daniel Harrington
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-01-10 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: gyoku
@@ -38,6 +37,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -104,7 +117,6 @@ licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'true'
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -112,15 +124,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.10
-signing_key: 
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Web Service Security
 test_files: []