moxml 0.1.24 → 0.1.26

data/spec/moxml/signature/model_spec.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/signature"
+
+RSpec.describe Moxml::Signature::Model do
+  describe Moxml::Signature::Model::Signature do
+    it "stores its components" do
+      si = Moxml::Signature::Model::SignedInfo.new
+      sv = Moxml::Signature::Model::SignatureValue.new(value: "abc")
+      sig = described_class.new(id: "S1", signed_info: si, signature_value: sv)
+      expect(sig.id).to eq("S1")
+      expect(sig.signed_info).to equal(si)
+      expect(sig.signature_value).to equal(sv)
+      expect(sig.objects).to eq([])
+    end
+  end
+
+  describe Moxml::Signature::Model::Reference do
+    it "accepts uri, transforms, and digest method" do
+      t = Moxml::Signature::Model::Transforms.new(
+        transforms: [Moxml::Signature::Model::Transform.new(
+          algorithm: "http://www.w3.org/2000/09/xmldsig#enveloped-signature",
+        )],
+      )
+      dm = Moxml::Signature::Model::DigestMethod.new(
+        algorithm: "http://www.w3.org/2001/04/xmlenc#sha256",
+      )
+      ref = described_class.new(uri: "", transforms: t, digest_method: dm,
+                                digest_value: "abc=")
+      expect(ref.uri).to eq("")
+      expect(ref.transforms.transforms.size).to eq(1)
+      expect(ref.digest_method.algorithm).to eq(
+        "http://www.w3.org/2001/04/xmlenc#sha256",
+      )
+      expect(ref.digest_value).to eq("abc=")
+    end
+  end
+
+  describe Moxml::Signature::Model::Transforms do
+    it "is empty by default" do
+      expect(described_class.new).to be_empty
+    end
+
+    it "appends transforms with <<" do
+      transforms = described_class.new
+      t = Moxml::Signature::Model::Transform.new(
+        algorithm: "http://www.w3.org/2000/09/xmldsig#base64",
+      )
+      transforms << t
+      expect(transforms.size).to eq(1)
+    end
+  end
+end

data/spec/moxml/signature/round_trip_spec.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/signature"
+require "openssl"
+
+# End-to-end signing + verification, including tamper detection and
+# wrong-key rejection. Uses real model instances and real OpenSSL keys
+# per the project's "no doubles" rule.
+RSpec.describe "Moxml XML Signature end-to-end round trip" do
+  let(:ctx) { Moxml.new(:nokogiri) }
+  let(:private_key) { OpenSSL::PKey::RSA.generate(2048) }
+  let(:document_xml) { "<doc><greeting>Hello, World!</greeting></doc>" }
+
+  let(:common_options) do
+    {
+      context: ctx,
+      signature_method: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
+      canonicalization_method: "http://www.w3.org/2001/10/xml-exc-c14n#",
+      digest_method: "http://www.w3.org/2001/04/xmlenc#sha256",
+      reference_uri: "",
+      transforms: ["http://www.w3.org/2000/09/xmldsig#enveloped-signature"],
+    }
+  end
+
+  def sign_and_attach(xml, key, **opts)
+    doc = ctx.parse(xml)
+    signature = Moxml::Signature.sign(document: doc, key: key, **common_options.merge(opts))
+    serialized = Moxml::Signature::Serializer.new(context: ctx).serialize(signature)
+    doc.root.add_child(serialized.root)
+    doc
+  end
+
+  describe "RSA-SHA256 round trip" do
+    it "verifies a freshly-signed document" do
+      doc = sign_and_attach(document_xml, private_key)
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: private_key)
+      expect(result.valid?).to be true
+      expect(result.signature_count).to eq(1)
+    end
+
+    it "verifies with the public key alone" do
+      doc = sign_and_attach(document_xml, private_key)
+      pub = OpenSSL::PKey::RSA.new(private_key.public_to_pem)
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: pub)
+      expect(result.valid?).to be true
+    end
+
+    it "detects payload tampering" do
+      doc = sign_and_attach(document_xml, private_key)
+      greeting = doc.at_xpath("//greeting")
+      greeting.text = "Goodbye, World!"
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: private_key)
+      expect(result.valid?).to be false
+      # SignatureValue still matches (SignedInfo unchanged) but reference
+      # digest mismatches.
+      expect(result.results.first.signature_valid?).to be true
+      expect(result.results.first.references.first.valid?).to be false
+    end
+
+    it "detects SignedInfo tampering" do
+      doc = sign_and_attach(document_xml, private_key)
+      dv = doc.at_xpath("//ds:DigestValue",
+                        "ds" => "http://www.w3.org/2000/09/xmldsig#")
+      dv.text = Base64.strict_encode64("x" * 32)
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: private_key)
+      expect(result.valid?).to be false
+    end
+
+    it "rejects an unrelated verification key" do
+      doc = sign_and_attach(document_xml, private_key)
+      other = OpenSSL::PKey::RSA.generate(2048)
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: other)
+      expect(result.valid?).to be false
+      expect(result.results.first.signature_valid?).to be false
+    end
+  end
+
+  describe "HMAC-SHA256 round trip" do
+    let(:hmac_options) do
+      common_options.merge(
+        signature_method: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256",
+      )
+    end
+
+    it "verifies with the shared secret" do
+      doc = sign_and_attach(document_xml, "shared-secret", **hmac_options)
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: "shared-secret")
+      expect(result.valid?).to be true
+    end
+
+    it "rejects the wrong secret" do
+      doc = sign_and_attach(document_xml, "shared-secret", **hmac_options)
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: "wrong-secret")
+      expect(result.valid?).to be false
+    end
+  end
+
+  describe "fixture key" do
+    let(:pem_path) do
+      File.expand_path("../../fixtures/xmldsig/keys/rsa_private.pem", __dir__)
+    end
+    let(:fixture_key) { OpenSSL::PKey::RSA.new(File.read(pem_path)) }
+
+    it "loads and round-trips" do
+      skip "fixture key not present" unless File.exist?(pem_path)
+
+      doc = sign_and_attach(document_xml, fixture_key)
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: fixture_key)
+      expect(result.valid?).to be true
+    end
+  end
+end

data/spec/moxml/xpath/functions/node_functions_spec.rb

@@ -57,7 +57,7 @@ RSpec.describe "XPath Node Functions" do
       result = proc.call(doc)
 
       # Depending on adapter, may include ns: prefix
-      expect(result).to match(/item/)
+      expect(result).to include("item")
     end
 
     it "returns empty string when no node matched" do

data/spec/spec_helper.rb

@@ -101,7 +101,7 @@ RSpec.configure do |config|
 end
 
 Moxml.configure do |config|
-  config.adapter = RUBY_ENGINE == "opal" ? :rexml : :nokogiri
+  config.adapter = RUBY_ENGINE == "opal" ? Moxml::Config::OPAL_DEFAULT_ADAPTER : Moxml::Config::DEFAULT_ADAPTER
   config.strict_parsing = true
   config.default_encoding = "UTF-8"
   config.entity_load_mode = :optional if RUBY_ENGINE == "opal"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: moxml
 version: !ruby/object:Gem::Version
-  version: 0.1.24
+  version: 0.1.26
 platform: ruby
 authors:
 - Ribose Inc.
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-06-02 00:00:00.000000000 Z
+date: 2026-07-22 00:00:00.000000000 Z
 dependencies: []
 description: |
   Moxml is a unified XML manipulation library that provides a common API
@@ -28,6 +28,7 @@ files:
 - ".github/workflows/release.yml"
 - ".github/workflows/round-trip.yml"
 - ".gitignore"
+- ".gitmodules"
 - ".rspec"
 - ".rspec-opal"
 - ".rubocop.yml"
@@ -81,6 +82,13 @@ files:
 - docs/_tutorials/namespace-handling.adoc
 - docs/_tutorials/xpath-queries.adoc
 - docs/index.adoc
+- docs/signature/algorithms.md
+- docs/signature/architecture.md
+- docs/signature/c14n.md
+- docs/signature/examples.md
+- docs/signature/flows.md
+- docs/signature/quick-reference.md
+- docs/signature/security.md
 - examples/README.md
 - examples/api_client/README.md
 - examples/api_client/api_client.rb
@@ -95,6 +103,9 @@ files:
 - examples/sax_parsing/example.xml
 - examples/sax_parsing/large_file.rb
 - examples/sax_parsing/simple_parser.rb
+- examples/signature/auto_key_extraction.rb
+- examples/signature/enveloped_rsa.rb
+- examples/signature/hmac.rb
 - examples/web_scraper/README.md
 - examples/web_scraper/example_page.html
 - examples/web_scraper/web_scraper.rb
@@ -138,6 +149,27 @@ files:
 - lib/moxml/adapter/rexml.rb
 - lib/moxml/attribute.rb
 - lib/moxml/builder.rb
+- lib/moxml/c14n.rb
+- lib/moxml/c14n/attribute_handler.rb
+- lib/moxml/c14n/character_encoder.rb
+- lib/moxml/c14n/data_model.rb
+- lib/moxml/c14n/exclusive.rb
+- lib/moxml/c14n/inclusive_10.rb
+- lib/moxml/c14n/inclusive_11.rb
+- lib/moxml/c14n/namespace_context.rb
+- lib/moxml/c14n/namespace_handler.rb
+- lib/moxml/c14n/node.rb
+- lib/moxml/c14n/nodes.rb
+- lib/moxml/c14n/nodes/attribute_node.rb
+- lib/moxml/c14n/nodes/comment_node.rb
+- lib/moxml/c14n/nodes/element_node.rb
+- lib/moxml/c14n/nodes/namespace_node.rb
+- lib/moxml/c14n/nodes/processing_instruction_node.rb
+- lib/moxml/c14n/nodes/root_node.rb
+- lib/moxml/c14n/nodes/text_node.rb
+- lib/moxml/c14n/processor.rb
+- lib/moxml/c14n/writer.rb
+- lib/moxml/c14n/xml_base_handler.rb
 - lib/moxml/cdata.rb
 - lib/moxml/comment.rb
 - lib/moxml/config.rb
@@ -163,6 +195,55 @@ files:
 - lib/moxml/sax/element_handler.rb
 - lib/moxml/sax/handler.rb
 - lib/moxml/sax/namespace_splitter.rb
+- lib/moxml/signature.rb
+- lib/moxml/signature/algorithms.rb
+- lib/moxml/signature/algorithms/base64_transform.rb
+- lib/moxml/signature/algorithms/canonicalization_base.rb
+- lib/moxml/signature/algorithms/digest_base.rb
+- lib/moxml/signature/algorithms/dsa_sha.rb
+- lib/moxml/signature/algorithms/ecdsa_sha.rb
+- lib/moxml/signature/algorithms/enveloped_signature_transform.rb
+- lib/moxml/signature/algorithms/exc_c14n_10.rb
+- lib/moxml/signature/algorithms/hmac_sha.rb
+- lib/moxml/signature/algorithms/inclusive_c14n_10.rb
+- lib/moxml/signature/algorithms/inclusive_c14n_11.rb
+- lib/moxml/signature/algorithms/rsa_pkcs1_sha.rb
+- lib/moxml/signature/algorithms/sha1.rb
+- lib/moxml/signature/algorithms/sha224.rb
+- lib/moxml/signature/algorithms/sha256.rb
+- lib/moxml/signature/algorithms/sha384.rb
+- lib/moxml/signature/algorithms/sha512.rb
+- lib/moxml/signature/algorithms/signature_method_base.rb
+- lib/moxml/signature/algorithms/transform_base.rb
+- lib/moxml/signature/errors.rb
+- lib/moxml/signature/key_extractor.rb
+- lib/moxml/signature/model.rb
+- lib/moxml/signature/model/algorithm_method.rb
+- lib/moxml/signature/model/digest_method.rb
+- lib/moxml/signature/model/key/dsa_key_value.rb
+- lib/moxml/signature/model/key/ec_key_value.rb
+- lib/moxml/signature/model/key/rsa_key_value.rb
+- lib/moxml/signature/model/key/x509_data.rb
+- lib/moxml/signature/model/key/x509_digest.rb
+- lib/moxml/signature/model/key/x509_issuer_serial.rb
+- lib/moxml/signature/model/key_info.rb
+- lib/moxml/signature/model/key_value.rb
+- lib/moxml/signature/model/object_element.rb
+- lib/moxml/signature/model/reference.rb
+- lib/moxml/signature/model/signature.rb
+- lib/moxml/signature/model/signature_value.rb
+- lib/moxml/signature/model/signed_info.rb
+- lib/moxml/signature/model/transform.rb
+- lib/moxml/signature/model/transforms.rb
+- lib/moxml/signature/parser.rb
+- lib/moxml/signature/reference_resolver.rb
+- lib/moxml/signature/reference_result.rb
+- lib/moxml/signature/serializer.rb
+- lib/moxml/signature/signer.rb
+- lib/moxml/signature/single_verification_result.rb
+- lib/moxml/signature/transform_pipeline.rb
+- lib/moxml/signature/verification_result.rb
+- lib/moxml/signature/verifier.rb
 - lib/moxml/text.rb
 - lib/moxml/version.rb
 - lib/moxml/xml_utils.rb
@@ -181,6 +262,8 @@ files:
 - lib/moxml/xpath/ruby/node.rb
 - moxml.gemspec
 - old-specs/moxml/adapter/customized_libxml/.gitkeep
+- reference-docs/w3c-xmldsig-bestpractices.md
+- reference-docs/w3c-xmldsig-core.md
 - scripts/format_xml.rb
 - scripts/pretty_format_xml.rb
 - sig/moxml.rbs
@@ -278,6 +361,13 @@ files:
 - spec/fixtures/w3c/namespaces/1.0/LICENSE.md
 - spec/fixtures/w3c/namespaces/1.0/README.adoc
 - spec/fixtures/w3c/namespaces/1.0/rmt-ns10.xml
+- spec/fixtures/xmldsig/keys/rsa_private.pem
+- spec/fixtures/xmldsig/keys/rsa_public.pem
+- spec/fixtures/xmldsig/keys/rsa_ref.pem
+- spec/fixtures/xmldsig/keys/rsa_ref.pub
+- spec/fixtures/xmldsig/sign2-doc.xml
+- spec/fixtures/xmldsig/sign2-result.xml
+- spec/fixtures/xmldsig/sign3-result.xml
 - spec/integration/README.md
 - spec/integration/all_adapters_spec.rb
 - spec/integration/headed_ox_integration_spec.rb
@@ -325,6 +415,12 @@ files:
 - spec/moxml/allocation_guard_spec.rb
 - spec/moxml/attribute_spec.rb
 - spec/moxml/builder_spec.rb
+- spec/moxml/c14n/api_spec.rb
+- spec/moxml/c14n/c14n_spec.rb
+- spec/moxml/c14n/comments_pis_spec.rb
+- spec/moxml/c14n/inclusive10_spec.rb
+- spec/moxml/c14n/namespace_edge_cases_spec.rb
+- spec/moxml/c14n/xml_attributes_spec.rb
 - spec/moxml/cdata_spec.rb
 - spec/moxml/comment_spec.rb
 - spec/moxml/config_spec.rb
@@ -352,11 +448,28 @@ files:
 - spec/moxml/node_set_spec.rb
 - spec/moxml/node_spec.rb
 - spec/moxml/node_type_map_spec.rb
+- spec/moxml/opal_oga_adapter_spec.rb
+- spec/moxml/opal_oga_features_spec.rb
+- spec/moxml/opal_oga_smoke_spec.rb
 - spec/moxml/opal_rexml_adapter_spec.rb
 - spec/moxml/opal_smoke_spec.rb
 - spec/moxml/processing_instruction_spec.rb
 - spec/moxml/sax/namespace_splitter_spec.rb
 - spec/moxml/sax_spec.rb
+- spec/moxml/signature/algorithms/base64_transform_spec.rb
+- spec/moxml/signature/algorithms/digest_base_spec.rb
+- spec/moxml/signature/algorithms/dsa_sha_spec.rb
+- spec/moxml/signature/algorithms/ecdsa_sha_spec.rb
+- spec/moxml/signature/algorithms/enveloped_signature_transform_spec.rb
+- spec/moxml/signature/algorithms/hmac_sha_spec.rb
+- spec/moxml/signature/algorithms/rsa_pkcs1_sha_spec.rb
+- spec/moxml/signature/algorithms_spec.rb
+- spec/moxml/signature/cross_verify_spec.rb
+- spec/moxml/signature/edge_cases_spec.rb
+- spec/moxml/signature/fixtures_spec.rb
+- spec/moxml/signature/key_extractor_spec.rb
+- spec/moxml/signature/model_spec.rb
+- spec/moxml/signature/round_trip_spec.rb
 - spec/moxml/text_spec.rb
 - spec/moxml/version_spec.rb
 - spec/moxml/xml_utils/.gitkeep