moxml 0.1.24 → 0.1.26

data/lib/moxml/c14n/nodes.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Moxml
+  module C14n
+    # C14N data-model node types. All nodes inherit from {Moxml::C14n::Node}.
+    module Nodes
+      autoload :AttributeNode, "moxml/c14n/nodes/attribute_node"
+      autoload :CommentNode, "moxml/c14n/nodes/comment_node"
+      autoload :ElementNode, "moxml/c14n/nodes/element_node"
+      autoload :NamespaceNode, "moxml/c14n/nodes/namespace_node"
+      autoload :ProcessingInstructionNode,
+               "moxml/c14n/nodes/processing_instruction_node"
+      autoload :RootNode, "moxml/c14n/nodes/root_node"
+      autoload :TextNode, "moxml/c14n/nodes/text_node"
+    end
+  end
+end

data/lib/moxml/c14n/processor.rb

@@ -0,0 +1,118 @@
+# frozen_string_literal: true
+
+module Moxml
+  module C14n
+    # C14N 1.0/1.1 processor. Walks the data model and emits canonical
+    # octets. Handles node-set subsets (omitted ancestors), xml:base
+    # fixup, and xml:* inheritable attribute resolution.
+    #
+    # Ported from canon (lutaml/canon).
+    class Processor
+      attr_reader :with_comments
+
+      def initialize(with_comments: false)
+        @with_comments = with_comments
+        @encoder = CharacterEncoder.new
+        @namespace_handler = NamespaceHandler.new(@encoder)
+        @attribute_handler = AttributeHandler.new(@encoder)
+        @xml_base_handler = XmlBaseHandler.new
+      end
+
+      def process(root_node)
+        output = (+"")
+        process_node(root_node, output)
+        output
+      end
+
+      private
+
+      def process_node(node, output, parent_element = nil, omitted_ancestors = [])
+        case node.node_type
+        when :root
+          node.children.each { |child| process_node(child, output) }
+        when :element
+          process_element_node(node, output, parent_element, omitted_ancestors)
+        when :text
+          process_text_node(node, output)
+        when :comment
+          process_comment_node(node, output, parent_element)
+        when :processing_instruction
+          process_pi_node(node, output, parent_element)
+        end
+      end
+
+      def process_element_node(node, output, parent_element, omitted_ancestors)
+        if node.in_node_set?
+          render_element(node, output, parent_element, omitted_ancestors)
+        else
+          # Element not in node-set, but its children may be. Pass the
+          # element as an omitted ancestor for inheritable-attr fixup.
+          new_omitted = omitted_ancestors + [node]
+          node.children.each do |child|
+            process_node(child, output, parent_element, new_omitted)
+          end
+        end
+      end
+
+      def render_element(node, output, parent_element, omitted_ancestors)
+        output << "<" << node.qname
+
+        @namespace_handler.process_namespaces(node, output, parent_element)
+        process_element_attributes(node, output, omitted_ancestors)
+
+        output << ">"
+
+        node.children.each { |child| process_node(child, output, node, []) }
+
+        output << "</" << node.qname << ">"
+      end
+
+      def process_element_attributes(node, output, omitted_ancestors)
+        @attribute_handler.process_attributes(node, output, omitted_ancestors)
+
+        return unless omitted_ancestors.any?
+
+        fixed_base = @xml_base_handler.fixup_xml_base(node, omitted_ancestors)
+        return unless fixed_base && !fixed_base.empty?
+
+        has_base = node.attribute_nodes.any?(&:xml_base?)
+        return if has_base
+
+        output << ' xml:base="'
+        output << @encoder.encode_attribute(fixed_base)
+        output << '"'
+      end
+
+      def process_text_node(node, output)
+        return unless node.in_node_set?
+
+        output << @encoder.encode_text(node.value)
+      end
+
+      def process_comment_node(node, output, parent_element)
+        return unless with_comments
+        return unless node.in_node_set?
+
+        # Comment outside the document element gets a line break before/after
+        # to keep canonical output readable.
+        if parent_element.nil? && output.length.positive?
+          output << "\n"
+        end
+        output << "<!--" << node.value << "-->"
+        output << "\n" if parent_element.nil?
+      end
+
+      def process_pi_node(node, output, parent_element)
+        return unless node.in_node_set?
+
+        if parent_element.nil? && output.length.positive?
+          output << "\n"
+        end
+        output << "<?" << node.target
+        output << " " << node.data unless node.data.to_s.empty?
+        output << "?>"
+        output << "\n" if parent_element.nil?
+      end
+    end
+  end
+end

data/lib/moxml/c14n/writer.rb

@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+
+module Moxml
+  module C14n
+    # Builds canonical octet output incrementally.
+    # Output is always UTF-8 with no BOM.
+    class Writer
+      attr_reader :output
+
+      def initialize
+        @output = (+"")
+        # Tracks namespaces already rendered in the output ancestor chain,
+        # so descendants don't re-render the same declaration.
+        # Key: element (by object identity), value: { prefix => uri }.
+        @rendered_stack = []
+      end
+
+      def <<(str)
+        @output << str
+        self
+      end
+
+      def raw(str)
+        @output << str.to_s
+        self
+      end
+
+      # Push a fresh "rendered" frame for the given element. Called by the
+      # canonicalizer before rendering the element's namespaces.
+      def open_rendered_frame(element)
+        parent_rendered = @rendered_stack.last || {}
+        # Inherit parent's rendered namespaces as the starting set.
+        @rendered_stack.push(parent_rendered.dup)
+        element
+      end
+
+      def close_rendered_frame
+        @rendered_stack.pop
+        self
+      end
+
+      def rendered_namespaces_for(_element)
+        @rendered_stack.last || {}
+      end
+
+      def mark_rendered(_element, prefix, uri)
+        (@rendered_stack.last || {})[prefix] = uri
+        self
+      end
+
+      def open_tag(prefix, local)
+        @output << "<"
+        @output << "#{prefix}:" unless prefix.nil? || prefix.empty?
+        @output << local
+        self
+      end
+
+      def close_tag_open
+        @output << ">"
+        self
+      end
+
+      def close_tag_self_close
+        @output << "></"
+        self
+      end
+
+      def close_tag(prefix, local)
+        @output << "</"
+        @output << "#{prefix}:" unless prefix.nil? || prefix.empty?
+        @output << local
+        @output << ">"
+        self
+      end
+
+      def attribute(expanded_name, value)
+        @output << " "
+        @output << expanded_name
+        @output << "=\""
+        @output << C14n.escape_attribute(value)
+        @output << "\""
+        self
+      end
+
+      def namespace(prefix, uri)
+        @output << " "
+        if prefix.nil? || prefix.empty?
+          @output << "xmlns"
+        else
+          @output << "xmlns:"
+          @output << prefix
+        end
+        @output << "=\""
+        @output << C14n.escape_attribute(uri)
+        @output << "\""
+        self
+      end
+
+      def text(content)
+        @output << C14n.escape_text(content)
+        self
+      end
+
+      def comment(content)
+        @output << "<!--"
+        @output << C14n.escape_text(content)
+        @output << "-->"
+        self
+      end
+
+      def processing_instruction(target, content)
+        @output << "<?"
+        @output << target
+        @output << " "
+        @output << content
+        @output << "?>"
+        self
+      end
+    end
+  end
+end

data/lib/moxml/c14n/xml_base_handler.rb

@@ -0,0 +1,140 @@
+# frozen_string_literal: true
+
+require "uri"
+
+module Moxml
+  module C14n
+    # xml:base fixup handler for document subsets (C14N 1.1 §2.4).
+    # Implements RFC 3986 URI joining with C14N 1.1 modifications.
+    class XmlBaseHandler
+      # Returns the fixed-up xml:base value to emit on the element, or
+      # nil if no fixup is needed.
+      def fixup_xml_base(element, omitted_ancestors)
+        return nil if omitted_ancestors.empty?
+
+        base_values = collect_base_values(element, omitted_ancestors)
+        return nil if base_values.empty?
+
+        join_base_values(base_values)
+      end
+
+      private
+
+      def collect_base_values(element, omitted_ancestors)
+        values = []
+        omitted_ancestors.each do |ancestor|
+          base_attr = ancestor.attribute_nodes.find(&:xml_base?)
+          values << base_attr.value if base_attr
+        end
+        element_base = element.attribute_nodes.find(&:xml_base?)
+        values << element_base.value if element_base
+        values
+      end
+
+      def join_base_values(values)
+        result = values.first
+        values[1..].each { |ref| result = join_uri_references(result, ref) }
+        result
+      end
+
+      # Join two URI references per RFC 3986 §5.2.1–5.2.4 with the
+      # C14N 1.1 modification (drop fragment).
+      def join_uri_references(base, ref)
+        ref_parts = parse_uri(ref)
+        return remove_dot_segments(ref_parts[:path] || "") if ref_parts[:scheme]
+
+        base_parts = parse_uri(base)
+        result_parts = {}
+
+        if ref_parts[:authority]
+          result_parts[:authority] = ref_parts[:authority]
+          result_parts[:path] = remove_dot_segments(ref_parts[:path] || "")
+          result_parts[:query] = ref_parts[:query]
+        else
+          if ref_parts[:path].nil? || ref_parts[:path].empty?
+            result_parts[:path] = base_parts[:path]
+            result_parts[:query] = ref_parts[:query] || base_parts[:query]
+          elsif ref_parts[:path].start_with?("/")
+            result_parts[:path] = remove_dot_segments(ref_parts[:path])
+          else
+            result_parts[:path] = remove_dot_segments(
+              merge_paths(base_parts[:path], ref_parts[:path]),
+            )
+          end
+          result_parts[:query] = ref_parts[:query]
+          result_parts[:authority] = base_parts[:authority]
+        end
+        result_parts[:scheme] = base_parts[:scheme]
+        reconstruct_uri(result_parts)
+      end
+
+      def parse_uri(uri_str)
+        parts = {}
+        if uri_str.to_s =~ %r{\A(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\?([^#]*))?(#(.*))?\z}
+          parts[:scheme] = Regexp.last_match(2)
+          parts[:authority] = Regexp.last_match(4)
+          parts[:path] = Regexp.last_match(5)
+          parts[:query] = Regexp.last_match(7)
+        end
+        parts
+      end
+
+      def merge_paths(base_path, ref_path)
+        if base_path&.include?("/")
+          base_path.sub(%r{/[^/]*\z}, "/#{ref_path}")
+        else
+          ref_path
+        end
+      end
+
+      # RFC 3986 §5.2.4 dot-segment removal with C14N 1.1 modifications.
+      TERMINAL_DOT_SEGMENTS = %w[. ..].freeze.freeze
+      private_constant :TERMINAL_DOT_SEGMENTS
+
+      def remove_dot_segments(path)
+        input = path.to_s.dup
+        input = input.sub(%r{/\.\.\z}, "/../")
+        output = +""
+
+        until input.empty?
+          if input.start_with?("../")
+            input = input[3..]
+          elsif input.start_with?("./")
+            input = input[2..]
+          elsif input.start_with?("/./")
+            input = "/#{input[3..]}"
+          elsif input == "/."
+            input = "/"
+          elsif input.start_with?("/../")
+            input = "/#{input[4..]}"
+            output = output.sub(%r{/[^/]*\z}, "")
+          elsif input == "/.."
+            input = "/"
+            output = output.sub(%r{/[^/]*\z}, "")
+          elsif TERMINAL_DOT_SEGMENTS.include?(input)
+            input = ""
+          else
+            seg_match = input.start_with?("/") ? input.match(%r{\A(/[^/]*)}) : input.match(%r{\A([^/]*)})
+            seg = seg_match[1]
+            input = input[seg.length..]
+            output << seg
+          end
+        end
+
+        output.squeeze("/").then do |out|
+          out << "/" if out.end_with?("/..")
+          out
+        end
+      end
+
+      def reconstruct_uri(parts)
+        result = +""
+        result << "#{parts[:scheme]}:" if parts[:scheme]
+        result << "//#{parts[:authority]}" if parts[:authority]
+        result << parts[:path].to_s if parts[:path]
+        result << "?#{parts[:query]}" if parts[:query]
+        result
+      end
+    end
+  end
+end

data/lib/moxml/c14n.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+module Moxml
+  # Canonicalization engine. Core moxml feature — sibling to
+  # Moxml::XPath, Moxml::Builder, Moxml::SAX.
+  #
+  # Inclusive C14N (1.0 and 1.1) is ported from canon (lutaml/canon):
+  # mature, tested, full-featured (xml:base fixup, inheritable xml:*
+  # attribute resolution, node-set subset canonicalization).
+  #
+  # Exclusive C14N (1.0) is a moxml-native implementation; canon does
+  # not implement exclusive. It is required by XML signature to keep
+  # signatures valid when subdocuments are moved between contexts.
+  module C14n
+    autoload :Node, "moxml/c14n/node"
+    autoload :Nodes, "moxml/c14n/nodes"
+    autoload :DataModel, "moxml/c14n/data_model"
+    autoload :Processor, "moxml/c14n/processor"
+    autoload :CharacterEncoder, "moxml/c14n/character_encoder"
+    autoload :NamespaceHandler, "moxml/c14n/namespace_handler"
+    autoload :AttributeHandler, "moxml/c14n/attribute_handler"
+    autoload :XmlBaseHandler, "moxml/c14n/xml_base_handler"
+
+    # Engine classes used directly by signature algorithms.
+    autoload :Writer, "moxml/c14n/writer"
+    autoload :NamespaceContext, "moxml/c14n/namespace_context"
+    autoload :Exclusive, "moxml/c14n/exclusive"
+    autoload :Inclusive10, "moxml/c14n/inclusive_10"
+    autoload :Inclusive11, "moxml/c14n/inclusive_11"
+
+    XMLNS_URI = "http://www.w3.org/2000/xmlns/"
+    XML_URI = "http://www.w3.org/XML/1998/namespace"
+
+    # Canonicalize using the named algorithm.
+    #
+    # algorithm is one of:
+    #   :inclusive10  Canonical XML 1.0 (default; W3C REC-xml-c14n-20010315)
+    #   :inclusive11  Canonical XML 1.1 (W3C REC-xml-c14n11-20080502)
+    #   :exclusive10  Exclusive C14N 1.0 (W3C REC-xml-exc-c14n-20020718)
+    def self.canonicalize(node_or_xml, with_comments: false,
+                          algorithm: :inclusive10, inclusive_namespaces: [])
+      engine_for(algorithm).canonicalize(
+        node_or_xml,
+        with_comments: with_comments,
+        inclusive_namespaces: inclusive_namespaces,
+      )
+    end
+
+    def self.canonicalize_inclusive10(node_or_xml, with_comments: false)
+      Inclusive10.new.canonicalize(node_or_xml, with_comments: with_comments)
+    end
+
+    def self.canonicalize_inclusive11(node_or_xml, with_comments: false)
+      Inclusive11.new.canonicalize(node_or_xml, with_comments: with_comments)
+    end
+
+    def self.canonicalize_exclusive(node_or_xml, with_comments: false,
+                                    inclusive_namespaces: [])
+      Exclusive.new.canonicalize(
+        node_or_xml,
+        with_comments: with_comments,
+        inclusive_namespaces: inclusive_namespaces,
+      )
+    end
+
+    # Compare two XML inputs by their canonical forms.
+    def self.equivalent?(left, right, with_comments: false,
+                         algorithm: :inclusive10, inclusive_namespaces: [])
+      canonicalize(left, with_comments: with_comments, algorithm: algorithm,
+                         inclusive_namespaces: inclusive_namespaces) ==
+        canonicalize(right, with_comments: with_comments, algorithm: algorithm,
+                            inclusive_namespaces: inclusive_namespaces)
+    end
+
+    def self.escape_text(text)
+      CharacterEncoder.new.encode_text(text)
+    end
+
+    def self.escape_attribute(value)
+      CharacterEncoder.new.encode_attribute(value)
+    end
+
+    def self.engine_for(algorithm)
+      case algorithm
+      when :inclusive10 then Inclusive10.new
+      when :inclusive11 then Inclusive11.new
+      when :exclusive10 then Exclusive.new
+      else
+        raise ArgumentError,
+              "unknown C14N algorithm #{algorithm.inspect}; expected one of " \
+              ":inclusive10, :inclusive11, :exclusive10"
+      end
+    end
+    private_class_method :engine_for
+  end
+end

data/lib/moxml/config.rb

@@ -7,7 +7,7 @@ module Moxml
     VALID_LINE_ENDINGS = [LINE_ENDING_LF, LINE_ENDING_CRLF].freeze
     VALID_ADAPTERS = %i[nokogiri oga rexml ox headed_ox libxml].freeze
     DEFAULT_ADAPTER = :nokogiri
-    OPAL_DEFAULT_ADAPTER = :rexml
+    OPAL_DEFAULT_ADAPTER = :oga
 
     # Entity loading modes:
     # - :required - Must load entities, raise error if unavailable (default)

data/lib/moxml/signature/algorithms/base64_transform.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require "base64"
+
+module Moxml
+  module Signature
+    module Algorithms
+      # Base64 decode transform (W3C §6.6.2).
+      #
+      # Input: octets or nodeset. For nodeset, logically applies self::text(),
+      # sorts nodes by document order, concatenates string values, then decodes.
+      # Output: octets.
+      class Base64Transform < TransformBase
+        identifier "http://www.w3.org/2000/09/xmldsig#base64"
+
+        def self.input_type; :octets; end
+        def self.output_type; :octets; end
+
+        def transform(input)
+          text = input.is_a?(Array) ? input.map { |n| text_of(n) }.join : input.to_s
+          stripped = text.gsub(/\s+/, "")
+          Base64.strict_decode64(stripped)
+        rescue ArgumentError => e
+          raise TransformError.new(
+            "base64 decode failed: #{e.message}",
+            algorithm: self.class.identifier_uri,
+          )
+        end
+
+        private
+
+        def text_of(node)
+          return node.text if node.is_a?(::Moxml::Node)
+
+          node.to_s
+        end
+      end
+    end
+  end
+end

data/lib/moxml/signature/algorithms/canonicalization_base.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+require "openssl"
+
+module Moxml
+  module Signature
+    module Algorithms
+      # Base class for canonicalization algorithms.
+      #
+      # Subclasses declare `identifier "http://..."` and implement #engine
+      # (returning a Moxml::C14n::* walker). Canonicalizers operate on a
+      # Moxml::Node subtree and return UTF-8 octets.
+      #
+      # Canonicalization algorithms can also be used as transforms per
+      # spec §6.6.1. The base class provides the #transform method that
+      # adapts the canonicalize interface to the transform pipeline.
+      class CanonicalizationBase
+        class << self
+          # Canonicalization presents the transform interface (spec §6.6.1).
+          # Input: octet stream or node-set. Output: octet stream.
+          def input_type; :nodeset; end
+
+          def output_type; :octets; end
+
+          def identifier(uri)
+            Algorithms.register(:canonicalization, uri, self)
+          end
+
+          def for_uri(uri, **opts)
+            new(identifier_uri: uri, **opts)
+          end
+        end
+
+        attr_reader :identifier_uri, :with_comments, :inclusive_namespaces,
+                    :context
+
+        # `context:` is required when this algorithm is used as a transform
+        # so that octet-stream input can be parsed with the same adapter
+        # the caller used for the rest of the document.
+        def initialize(identifier_uri: nil, with_comments: nil,
+                       inclusive_namespaces: [], context: nil, **_unused)
+          @identifier_uri = identifier_uri
+          @with_comments = with_comments.nil? ? uri_has_comments?(identifier_uri) : with_comments
+          @inclusive_namespaces = inclusive_namespaces || []
+          @context = context
+        end
+
+        def canonicalize(node)
+          engine.canonicalize(
+            node,
+            with_comments: @with_comments,
+            inclusive_namespaces: @inclusive_namespaces,
+          )
+        end
+
+        # Adapt to the transform interface (spec §6.6.1). Octet-stream
+        # input is parsed using the same Moxml::Context the caller used;
+        # this preserves the byte-exact invariant across adapters.
+        def transform(input)
+          return canonicalize(input) if input.is_a?(::Moxml::Node)
+
+          if context.nil?
+            raise TransformError,
+                  "canonicalization transform requires a context to parse " \
+                  "octet-stream input; none was provided"
+          end
+
+          parsed = context.parse(input.to_s)
+          canonicalize(parsed.root)
+        end
+
+        private
+
+        def uri_has_comments?(uri)
+          return false if uri.nil?
+
+          uri.end_with?("#WithComments")
+        end
+
+        def engine
+          raise NotImplementedError,
+                "#{self.class} must implement #engine"
+        end
+      end
+    end
+  end
+end

data/lib/moxml/signature/algorithms/digest_base.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "base64"
+
+module Moxml
+  module Signature
+    module Algorithms
+      # Base class for message digest algorithms (SHA family).
+      #
+      # Subclasses MUST declare:
+      #   - `identifier "http://..."` to register
+      #   - either `digest_bits N` and `openssl_digest_name "SHA256"` etc.,
+      #     OR override `#compute_digest`.
+      class DigestBase
+        class << self
+          attr_reader :identifier_uri, :digest_size_bits
+
+          def identifier(uri)
+            @identifier_uri = uri
+            Algorithms.register(:digest, uri, self)
+          end
+
+          def digest_bits(bits)
+            @digest_size_bits = bits
+          end
+
+          def openssl_digest_name(name)
+            define_method(:compute_digest) do |data|
+              OpenSSL::Digest.digest(name, data)
+            end
+          end
+        end
+
+        def digest(data)
+          compute_digest(data.to_s)
+        end
+
+        def digest_base64(data)
+          Base64.strict_encode64(digest(data))
+        end
+
+        def compute_digest(_data)
+          raise NotImplementedError,
+                "#{self.class} must implement #compute_digest " \
+                "or declare openssl_digest_name"
+        end
+      end
+    end
+  end
+end