moxml 0.1.25 → 0.2.0

data/spec/moxml/signature/key_extractor_spec.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/signature"
+require "openssl"
+
+RSpec.describe Moxml::Signature::KeyExtractor do
+  let(:extractor) { described_class.new }
+
+  describe "RSAKeyValue" do
+    let(:rsa_key) { OpenSSL::PKey::RSA.generate(2048) }
+
+    it "reconstructs a public RSA key from Modulus and Exponent" do
+      require "base64"
+      n_b64 = Base64.strict_encode64(rsa_key.n.to_s(2))
+      e_b64 = Base64.strict_encode64(rsa_key.e.to_s(2))
+      key_value = Moxml::Signature::Model::KeyValue.new(
+        rsa_key_value: Moxml::Signature::Model::Key::RSAKeyValue.new(
+          modulus: n_b64,
+          exponent: e_b64,
+        ),
+      )
+      key_info = Moxml::Signature::Model::KeyInfo.new(key_value: key_value)
+      extracted = extractor.extract(key_info)
+      expect(extracted).to be_a(OpenSSL::PKey::RSA)
+      expect(extracted.n).to eq(rsa_key.n)
+      expect(extracted.e).to eq(rsa_key.e)
+    end
+  end
+
+  describe "X509Certificate" do
+    let(:rsa_key) { OpenSSL::PKey::RSA.generate(2048) }
+    let(:cert) do
+      # Generate a self-signed cert so we can round-trip the DER.
+      cert = OpenSSL::X509::Certificate.new
+      cert.version = 2
+      cert.serial = 1
+      cert.subject = OpenSSL::X509::Name.parse("/CN=test")
+      cert.issuer = cert.subject
+      cert.public_key = rsa_key
+      cert.not_before = Time.now
+      cert.not_after = Time.now + 3600
+      cert.sign(rsa_key, OpenSSL::Digest.new("SHA256"))
+      cert
+    end
+
+    it "extracts the public key from the certificate" do
+      require "base64"
+      key_info = Moxml::Signature::Model::KeyInfo.new(
+        x509_data: Moxml::Signature::Model::Key::X509Data.new(
+          # X509Certificate is stored as base64-encoded DER (spec §4.5.4).
+          certificates: [Base64.strict_encode64(cert.to_der)],
+        ),
+      )
+      extracted = extractor.extract(key_info)
+      expect(extracted).to be_a(OpenSSL::PKey::RSA)
+      expect(extracted.n).to eq(rsa_key.n)
+    end
+  end
+
+  describe "KeyName" do
+    it "looks up the key in the application-supplied map" do
+      key = OpenSSL::PKey::RSA.generate(2048)
+      extractor_with_map = described_class.new(key_map: { "my-key" => key })
+      key_info = Moxml::Signature::Model::KeyInfo.new(key_name: "my-key")
+      expect(extractor_with_map.extract(key_info)).to equal(key)
+    end
+
+    it "returns nil for an unknown key name" do
+      key_info = Moxml::Signature::Model::KeyInfo.new(key_name: "unknown")
+      expect(extractor.extract(key_info)).to be_nil
+    end
+  end
+
+  describe "ECKeyValue" do
+    it "reconstructs a P-256 public EC key" do
+      ec = OpenSSL::PKey::EC.generate("prime256v1")
+      # Spec §4.5.2.3: PublicKey contains the uncompressed-point form
+      # 0x04 || x || y, base64-encoded.
+      point_octets = ec.public_key.to_octet_string(:uncompressed)
+      ec_pub_b64 = Base64.strict_encode64(point_octets)
+
+      key_info = Moxml::Signature::Model::KeyInfo.new(
+        key_value: Moxml::Signature::Model::KeyValue.new(
+          ec_key_value: Moxml::Signature::Model::Key::ECKeyValue.new(
+            named_curve_uri: "urn:oid:1.2.840.10045.3.1.7",
+            public_key: ec_pub_b64,
+          ),
+        ),
+      )
+      extracted = extractor.extract(key_info)
+      expect(extracted).to be_a(OpenSSL::PKey::EC)
+      expect(extracted.public_key).to eq(ec.public_key)
+    end
+  end
+end

data/spec/moxml/signature/model_spec.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/signature"
+
+RSpec.describe Moxml::Signature::Model do
+  describe Moxml::Signature::Model::Signature do
+    it "stores its components" do
+      si = Moxml::Signature::Model::SignedInfo.new
+      sv = Moxml::Signature::Model::SignatureValue.new(value: "abc")
+      sig = described_class.new(id: "S1", signed_info: si, signature_value: sv)
+      expect(sig.id).to eq("S1")
+      expect(sig.signed_info).to equal(si)
+      expect(sig.signature_value).to equal(sv)
+      expect(sig.objects).to eq([])
+    end
+  end
+
+  describe Moxml::Signature::Model::Reference do
+    it "accepts uri, transforms, and digest method" do
+      t = Moxml::Signature::Model::Transforms.new(
+        transforms: [Moxml::Signature::Model::Transform.new(
+          algorithm: "http://www.w3.org/2000/09/xmldsig#enveloped-signature",
+        )],
+      )
+      dm = Moxml::Signature::Model::DigestMethod.new(
+        algorithm: "http://www.w3.org/2001/04/xmlenc#sha256",
+      )
+      ref = described_class.new(uri: "", transforms: t, digest_method: dm,
+                                digest_value: "abc=")
+      expect(ref.uri).to eq("")
+      expect(ref.transforms.transforms.size).to eq(1)
+      expect(ref.digest_method.algorithm).to eq(
+        "http://www.w3.org/2001/04/xmlenc#sha256",
+      )
+      expect(ref.digest_value).to eq("abc=")
+    end
+  end
+
+  describe Moxml::Signature::Model::Transforms do
+    it "is empty by default" do
+      expect(described_class.new).to be_empty
+    end
+
+    it "appends transforms with <<" do
+      transforms = described_class.new
+      t = Moxml::Signature::Model::Transform.new(
+        algorithm: "http://www.w3.org/2000/09/xmldsig#base64",
+      )
+      transforms << t
+      expect(transforms.size).to eq(1)
+    end
+  end
+end

data/spec/moxml/signature/round_trip_spec.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "moxml/signature"
+require "openssl"
+
+# End-to-end signing + verification, including tamper detection and
+# wrong-key rejection. Uses real model instances and real OpenSSL keys
+# per the project's "no doubles" rule.
+RSpec.describe "Moxml XML Signature end-to-end round trip" do
+  let(:ctx) { Moxml.new(:nokogiri) }
+  let(:private_key) { OpenSSL::PKey::RSA.generate(2048) }
+  let(:document_xml) { "<doc><greeting>Hello, World!</greeting></doc>" }
+
+  let(:common_options) do
+    {
+      context: ctx,
+      signature_method: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
+      canonicalization_method: "http://www.w3.org/2001/10/xml-exc-c14n#",
+      digest_method: "http://www.w3.org/2001/04/xmlenc#sha256",
+      reference_uri: "",
+      transforms: ["http://www.w3.org/2000/09/xmldsig#enveloped-signature"],
+    }
+  end
+
+  def sign_and_attach(xml, key, **opts)
+    doc = ctx.parse(xml)
+    signature = Moxml::Signature.sign(document: doc, key: key, **common_options.merge(opts))
+    serialized = Moxml::Signature::Serializer.new(context: ctx).serialize(signature)
+    doc.root.add_child(serialized.root)
+    doc
+  end
+
+  describe "RSA-SHA256 round trip" do
+    it "verifies a freshly-signed document" do
+      doc = sign_and_attach(document_xml, private_key)
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: private_key)
+      expect(result.valid?).to be true
+      expect(result.signature_count).to eq(1)
+    end
+
+    it "verifies with the public key alone" do
+      doc = sign_and_attach(document_xml, private_key)
+      pub = OpenSSL::PKey::RSA.new(private_key.public_to_pem)
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: pub)
+      expect(result.valid?).to be true
+    end
+
+    it "detects payload tampering" do
+      doc = sign_and_attach(document_xml, private_key)
+      greeting = doc.at_xpath("//greeting")
+      greeting.text = "Goodbye, World!"
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: private_key)
+      expect(result.valid?).to be false
+      # SignatureValue still matches (SignedInfo unchanged) but reference
+      # digest mismatches.
+      expect(result.results.first.signature_valid?).to be true
+      expect(result.results.first.references.first.valid?).to be false
+    end
+
+    it "detects SignedInfo tampering" do
+      doc = sign_and_attach(document_xml, private_key)
+      dv = doc.at_xpath("//ds:DigestValue",
+                        "ds" => "http://www.w3.org/2000/09/xmldsig#")
+      dv.text = Base64.strict_encode64("x" * 32)
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: private_key)
+      expect(result.valid?).to be false
+    end
+
+    it "rejects an unrelated verification key" do
+      doc = sign_and_attach(document_xml, private_key)
+      other = OpenSSL::PKey::RSA.generate(2048)
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: other)
+      expect(result.valid?).to be false
+      expect(result.results.first.signature_valid?).to be false
+    end
+  end
+
+  describe "HMAC-SHA256 round trip" do
+    let(:hmac_options) do
+      common_options.merge(
+        signature_method: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256",
+      )
+    end
+
+    it "verifies with the shared secret" do
+      doc = sign_and_attach(document_xml, "shared-secret", **hmac_options)
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: "shared-secret")
+      expect(result.valid?).to be true
+    end
+
+    it "rejects the wrong secret" do
+      doc = sign_and_attach(document_xml, "shared-secret", **hmac_options)
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: "wrong-secret")
+      expect(result.valid?).to be false
+    end
+  end
+
+  describe "fixture key" do
+    let(:pem_path) do
+      File.expand_path("../../fixtures/xmldsig/keys/rsa_private.pem", __dir__)
+    end
+    let(:fixture_key) { OpenSSL::PKey::RSA.new(File.read(pem_path)) }
+
+    it "loads and round-trips" do
+      skip "fixture key not present" unless File.exist?(pem_path)
+
+      doc = sign_and_attach(document_xml, fixture_key)
+      result = Moxml::Signature.verify(context: ctx, document: doc, key: fixture_key)
+      expect(result.valid?).to be true
+    end
+  end
+end

data/spec/moxml/xml_emitter_spec.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+RSpec.describe Moxml::XmlEmitter do
+  describe ".escape_text" do
+    it "escapes only & < > in a single pass" do
+      expect(described_class.escape_text("a & < > ' \""))
+        .to eq("a &amp; &lt; &gt; ' \"")
+    end
+
+    it "returns clean strings unallocated" do
+      input = "clean"
+      expect(described_class.escape_text(input)).to equal(input)
+    end
+
+    it "coerces non-strings" do
+      expect(described_class.escape_text(1)).to eq("1")
+    end
+  end
+
+  describe ".escape_attribute" do
+    it "escapes & < > and double quotes, keeping apostrophes literal" do
+      expect(described_class.escape_attribute(%q{& < > ' "}))
+        .to eq("&amp; &lt; &gt; ' &quot;")
+    end
+  end
+
+  describe ".cdata" do
+    it "wraps content in a CDATA section" do
+      expect(described_class.cdata("data")).to eq("<![CDATA[data]]>")
+    end
+
+    it "splits an embedded end sequence into adjacent sections" do
+      expect(described_class.cdata("a]]>b"))
+        .to eq("<![CDATA[a]]]]><![CDATA[>b]]>")
+    end
+  end
+
+  describe ".declaration_xml" do
+    it "renders only the set attributes" do
+      expect(described_class.declaration_xml("1.0", nil, nil))
+        .to eq('<?xml version="1.0"?>')
+      expect(described_class.declaration_xml("1.0", "UTF-8", "yes"))
+        .to eq('<?xml version="1.0" encoding="UTF-8" standalone="yes"?>')
+    end
+
+    it "omits empty encodings" do
+      expect(described_class.declaration_xml("1.0", "", nil))
+        .to eq('<?xml version="1.0"?>')
+    end
+  end
+
+  describe ".doctype_xml" do
+    it "renders PUBLIC and SYSTEM forms and bare names" do
+      expect(described_class.doctype_xml("r", "pub", "sys"))
+        .to eq('<!DOCTYPE r PUBLIC "pub" "sys">')
+      expect(described_class.doctype_xml("r", nil, "sys"))
+        .to eq('<!DOCTYPE r SYSTEM "sys">')
+      expect(described_class.doctype_xml("r", nil, nil))
+        .to eq("<!DOCTYPE r>")
+    end
+  end
+end

data/spec/moxml/xpath/axes_spec.rb

@@ -163,6 +163,78 @@ RSpec.describe "XPath Axes" do
       end
     end
 
+    describe "attribute axis with namespaces" do
+      let(:ns_doc) do
+        xml = <<~XML
+          <root xmlns:p="http://x.org" xmlns:q="http://x.org">
+            <item q:type="namespaced" type="bare" other="o"/>
+          </root>
+        XML
+        context.parse(xml)
+      end
+
+      def select(expression, namespaces = nil)
+        ast = Moxml::XPath::Parser.parse(expression)
+        proc = Moxml::XPath::Compiler.compile_with_cache(ast,
+                                                         namespaces: namespaces)
+        proc.call(ns_doc).map(&:value)
+      end
+
+      it "matches bare names against no-namespace attributes only" do
+        expect(select("/root/item/@type")).to eq(["bare"])
+      end
+
+      it "matches prefixed names by namespace URI, not by prefix spelling" do
+        expect(select("/root/item/@p:type")).to eq(["namespaced"])
+        expect(select("/root/item/@q:type")).to eq(["namespaced"])
+      end
+
+      it "matches any local name within a prefix's namespace" do
+        expect(select("/root/item/@q:*")).to eq(["namespaced"])
+      end
+
+      it "matches nothing for an undeclared prefix" do
+        expect(select("/root/item/@z:type")).to be_empty
+      end
+
+      it "prefers context prefix mappings over document declarations" do
+        expect(select("/root/item/@p:type", "p" => "http://other.org"))
+          .to be_empty
+        expect(select("/root/item/@zzz:type", "zzz" => "http://x.org"))
+          .to eq(["namespaced"])
+      end
+    end
+
+    describe "descendant-or-self shorthand from an element" do
+      it "selects descendants with .//step" do
+        ast = Moxml::XPath::Parser.parse(".//grandchild")
+        proc = Moxml::XPath::Compiler.compile_with_cache(ast)
+        result = proc.call(doc.root.children.find(&:element?))
+
+        expect(result.map { |n| n.attribute("id").value })
+          .to contain_exactly("g1", "g2")
+      end
+    end
+
+    describe "node type tests as steps" do
+      it "selects text nodes with text()" do
+        ast = Moxml::XPath::Parser.parse("//grandchild/text()")
+        proc = Moxml::XPath::Compiler.compile_with_cache(ast)
+        result = proc.call(doc)
+
+        expect(result.map(&:content)).to contain_exactly("text1", "text2")
+      end
+
+      it "selects comments with comment()" do
+        commented = context.parse("<root><!-- c1 --><a/><!-- c2 --></root>")
+        ast = Moxml::XPath::Parser.parse("//comment()")
+        proc = Moxml::XPath::Compiler.compile_with_cache(ast)
+        result = proc.call(commented)
+
+        expect(result.map(&:content)).to contain_exactly(" c1 ", " c2 ")
+      end
+    end
+
     describe "descendant axis" do
       it "finds descendants without self" do
         ast = Moxml::XPath::Parser.parse("/root/descendant::child")

data/spec/moxml/xpath/parser_spec.rb

@@ -60,6 +60,12 @@ RSpec.describe Moxml::XPath::Parser do
         expect(ast.type).to eq(:relative_path)
       end
 
+      it "parses prefixed attribute names" do
+        ast = described_class.parse("@xmi:type")
+        expect(ast.type).to eq(:relative_path)
+        expect { described_class.parse("@xmi:*") }.not_to raise_error
+      end
+
       it "parses path with parent reference" do
         ast = described_class.parse("../book")
         expect(ast.type).to eq(:relative_path)

data/spec/moxml/xpath_capabilities_spec.rb

@@ -131,11 +131,13 @@ RSpec.describe "XPath Capabilities" do
       end
 
       describe "XPath functions" do
-        it "supports count() function" do
+        it "supports count() function, returning the scalar unwrapped" do
           doc = Moxml.new.parse(simple_xml)
-          # NOTE: count() returns a number, not nodes
           result = doc.xpath("count(//book)")
-          expect(result).to be_a(Numeric) if result.is_a?(Numeric)
+          # REXML's XPath has no function support and yields an empty set
+          skip "count() function not supported on #{adapter_name}" if result.is_a?(Moxml::NodeSet)
+
+          expect(result).to eq(2)
         rescue Moxml::XPathError, NoMethodError
           skip "count() function not supported on #{adapter_name}"
         end

data/spec/performance/benchmark_spec.rb

@@ -23,14 +23,21 @@ RSpec.shared_examples "Performance Examples" do
     context "measures performance" do
       let(:doc) { context.parse(large_xml) }
 
+      # Absolute ips varies more than 2x across machines and even between
+      # runs on the same machine (observed: rexml serializer 1.5-2.9 ips on
+      # one machine). These thresholds sit at roughly half of typical
+      # modern-runner throughput so they only trip on asymptotic
+      # regressions (accidental O(n^2), broken caching), not on hardware
+      # variance or a few percent of legitimate overhead.
       let(:thresholds) do
         {
-          nokogiri: { parser: 15, serializer: 1000 },
-          oga: { parser: 10, serializer: 100 },
-          rexml: { parser: 0, serializer: 5 },
-          ox: { parser: 2, serializer: 1000 },
-          headed_ox: { parser: 2, serializer: 1000 },
-          libxml: { parser: 500, serializer: 60 },
+          nokogiri: { parser: 8, serializer: 500 },
+          oga: { parser: 5, serializer: 50 },
+          rexml: { parser: 0, serializer: 1 },
+          ox: { parser: 1, serializer: 400 },
+          headed_ox: { parser: 1, serializer: 400 },
+          libxml: { parser: 200, serializer: 30 },
+          leptris: { parser: 1300, serializer: 600 },
         }
       end
 

data/spec/performance/thread_safety_spec.rb

@@ -20,10 +20,6 @@ RSpec.shared_examples "Thread Safety Examples" do
     end
 
     it "handles concurrent processing" do
-      if Moxml.new.config.adapter_name == :ox
-        skip "Ox doesn't have a native XPath"
-      end
-
       processor = processor_class.new
       threads = []
       results = Queue.new

data/spec/spec_helper.rb

@@ -101,7 +101,11 @@ RSpec.configure do |config|
 end
 
 Moxml.configure do |config|
-  config.adapter = RUBY_ENGINE == "opal" ? Moxml::Config::OPAL_DEFAULT_ADAPTER : Moxml::Config::DEFAULT_ADAPTER
+  # Pin the suite baseline to the fallback adapter so results are
+  # reproducible regardless of whether the local environment has a
+  # leptris new enough to win the runtime-default probe. Leptris gets
+  # full coverage through its explicit adapter/integration matrices.
+  config.adapter = RUBY_ENGINE == "opal" ? Moxml::Config::OPAL_DEFAULT_ADAPTER : Moxml::Config::FALLBACK_ADAPTER
   config.strict_parsing = true
   config.default_encoding = "UTF-8"
   config.entity_load_mode = :optional if RUBY_ENGINE == "opal"