nokogiri-xmlsec-instructure 0.9.6 → 0.10.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c07223507738529c34fd27ff24c166210d696fe53cc70abe02f93990a2ae0ff3
-  data.tar.gz: c16cb38b56a47c97f5db81801e1f82523492d3924c6ca529a4123e7301415b85
+  metadata.gz: 81d08ea19b4230b07f26533b8dc8d556a889e207a2a6194575231c5cf0aae318
+  data.tar.gz: '09595d365865a363d7395dec3289976fb852bf8dad138e497b40d1138f486083'
 SHA512:
-  metadata.gz: 55e33e2e79a14965296265d4498572c367c2fcae18ff07c82cd39a987a76760f19e988ee3e7e39d47d240b6952feead3e56744f03a0ac3b32cb7684a7848c450
-  data.tar.gz: 8afb1ff7ee7cab8861c3d30f396d7948b8897e2d49dbcc4b83beb8a0b870ef29c1b88361a1a9e915661f0bf3a862d69f7d4bd91e03cf6820406d24f5d745ac0a
+  metadata.gz: 0bf88cdf158f4766183b1e82bdcd4d68411caa0542773f5327a1d2cf74f04c3e7444a446d8bb3088cac4be596d2a61ffcdec85ca781a8078d00a7690c0c773a0
+  data.tar.gz: '02939e5f9cce8e6cc15f49befa60956ea9b72a0a461d7ee0c886233ca21795083e946a8140a83e1c5c317a7e3006d3bc1ab1bd689e414be0795bb5540691d6a4'

data/.github/workflows/push.yml

@@ -0,0 +1,40 @@
+name: Ruby
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+
+jobs:
+  test:
+
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby-version: [3.0, 2.7]
+        gemfile: ['gemfiles/nokogiri_13.10.gemfile', 'gemfiles/nokogiri_12.5.gemfile']
+
+    steps:
+      - name: Install libxmlsec
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libxmlsec1-dev
+      - uses: actions/checkout@v3
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby-version }}
+          bundler-cache: true
+        env:
+          BUNDLE_GEMFILE: ${{ matrix.gemfile }}
+      - name: Install dependencies
+        run: bundle install
+        env:
+          BUNDLE_GEMFILE: ${{ matrix.gemfile }}
+      - name: Run tests
+        run: bundle exec rake
+        env:
+          BUNDLE_GEMFILE: ${{ matrix.gemfile }}

data/.gitignore

@@ -1,6 +1,7 @@
 *.gem
 *.rbc
 .bundle
+.byebug_history
 .config
 .yardoc
 Gemfile.lock
@@ -9,6 +10,7 @@ _yardoc
 coverage
 doc/
 lib/bundler/man
+lib/nokogiri_ext_xmlsec.bundle
 pkg
 rdoc
 spec/reports
@@ -18,3 +20,4 @@ tmp
 spec/old
 *.so
 *.sw[opn]
+*.gemfile.lock

data/.tool-versions

@@ -0,0 +1 @@
+ruby 3.0.4

data/Appraisals

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+appraise "nokogiri-13.10" do
+  gem "nokogiri", "1.13.10"
+end
+
+appraise "nokogiri-12.5" do
+  gem "nokogiri", "1.12.5"
+end

data/README.md

@@ -10,6 +10,14 @@ to `Nokogiri::XML::Document`.
 
 ## Installation
 
+Install this before attempting to install; or else it may fail (tested on CentOS 7) while trying to find -lltdl from the xmlsec1-openssl lib. I'm guessing it's a dependency. Someone else may know more.
+    
+    # CentOS/RHEL
+    yum install libtool-ltdl-devel
+    
+    # Debian/Ubuntu
+    apt install -y libxmlsec1-dev
+
 Add this line to your application's Gemfile:
 
     gem 'nokogiri-xmlsec'

data/ext/nokogiri_ext_xmlsec/extconf.rb

@@ -1,4 +1,5 @@
 require 'mkmf'
+require 'nokogiri'
 
 def barf message = 'dependencies not met'
   raise message
@@ -22,6 +23,12 @@ puts "Ensure we escaping: #{$CFLAGS}"
   '-DXMLSEC_CRYPTO=\\"openssl\\"'
 end
 
+$CFLAGS << Dir[Gem.loaded_specs['nokogiri'].full_gem_path + "/ext/*"].map { |dir| " -I#{dir}"}.join("")
+
 puts "Clfags: #{$CFLAGS}"
 $libs = `xmlsec1-config  --libs`.strip
+
+# We reference symbols out of nokogiri but don't link directly against it
+$LDFLAGS << ' -Wl,-undefined,dynamic_lookup'
+
 create_makefile('nokogiri_ext_xmlsec')

data/ext/nokogiri_ext_xmlsec/nokogiri_decrypt_with_key.c

@@ -16,7 +16,7 @@ VALUE decrypt_with_key(VALUE self, VALUE rb_key_name, VALUE rb_key) {
 
   Check_Type(rb_key,      T_STRING);
   Check_Type(rb_key_name, T_STRING);
-  Data_Get_Struct(self, xmlNode, node);
+  Noko_Node_Get_Struct(self, xmlNode, node);
   key       = RSTRING_PTR(rb_key);
   keyLength = RSTRING_LEN(rb_key);
   keyName = StringValueCStr(rb_key_name);
@@ -58,7 +58,7 @@ done:
     // the replaced node is orphaned, but not freed; let Nokogiri
     // own it now
     if(encCtx->replacedNodeList != NULL) {
-      nokogiri_root_node(encCtx->replacedNodeList);
+      noko_xml_document_pin_node(encCtx->replacedNodeList);
       // no really, please don't free it
       encCtx->replacedNodeList = NULL;
     }

data/ext/nokogiri_ext_xmlsec/nokogiri_encrypt_with_key.c

@@ -12,9 +12,11 @@
 VALUE encrypt_with_key(VALUE self, VALUE rb_rsa_key_name, VALUE rb_rsa_key,
                        VALUE rb_opts) {
   VALUE rb_exception_result = Qnil;
+  VALUE rb_cert = Qnil;
   const char* exception_message = NULL;
 
   xmlDocPtr doc = NULL;
+  xmlNodePtr node = NULL;
   xmlNodePtr encDataNode = NULL;
   xmlNodePtr encKeyNode  = NULL;
   xmlNodePtr keyInfoNode = NULL;
@@ -22,17 +24,28 @@ VALUE encrypt_with_key(VALUE self, VALUE rb_rsa_key_name, VALUE rb_rsa_key,
   xmlSecKeysMngrPtr keyManager = NULL;
   char *keyName = NULL;
   char *key = NULL;
+  char *certificate = NULL;
   unsigned int keyLength = 0;
+  unsigned int certificateLength = 0;
 
   resetXmlSecError();
 
   Check_Type(rb_rsa_key,      T_STRING);
-  Check_Type(rb_rsa_key_name, T_STRING);
   Check_Type(rb_opts, T_HASH);
 
   key       = RSTRING_PTR(rb_rsa_key);
   keyLength = RSTRING_LEN(rb_rsa_key);
-  keyName = StringValueCStr(rb_rsa_key_name);
+  if (rb_rsa_key_name != Qnil) {
+    Check_Type(rb_rsa_key_name, T_STRING);
+    keyName = StringValueCStr(rb_rsa_key_name);
+  }
+
+  rb_cert = rb_hash_aref(rb_opts, ID2SYM(rb_intern("cert")));
+  if (!NIL_P(rb_cert)) {
+    Check_Type(rb_cert, T_STRING);
+    certificate = RSTRING_PTR(rb_cert);
+    certificateLength = RSTRING_LEN(rb_cert);
+  }
 
   XmlEncOptions options;
   if (!GetXmlEncOptions(rb_opts, &options, &rb_exception_result,
@@ -40,7 +53,8 @@ VALUE encrypt_with_key(VALUE self, VALUE rb_rsa_key_name, VALUE rb_rsa_key,
     goto done;
   }
 
-  Data_Get_Struct(self, xmlDoc, doc);
+  Noko_Node_Get_Struct(self, xmlNode, node);
+  doc = node->doc;
 
   // create encryption template to encrypt XML file and replace 
   // its content with encryption result
@@ -68,10 +82,21 @@ VALUE encrypt_with_key(VALUE self, VALUE rb_rsa_key_name, VALUE rb_rsa_key,
     goto done;
   }
 
-  if(xmlSecTmplKeyInfoAddKeyName(keyInfoNode, NULL) == NULL) {
-    rb_exception_result = rb_eEncryptionError;
-    exception_message = "failed to add key name";
-    goto done;
+  if(certificate) {
+    // add <dsig:X509Data/>
+    if(xmlSecTmplKeyInfoAddX509Data(keyInfoNode) == NULL) {
+      rb_exception_result = rb_eSigningError;
+      exception_message = "failed to add X509Data node";
+      goto done;
+    }
+  }
+
+  if(keyName != NULL) {
+    if(xmlSecTmplKeyInfoAddKeyName(keyInfoNode, NULL) == NULL) {
+      rb_exception_result = rb_eEncryptionError;
+      exception_message = "failed to add key name";
+      goto done;
+    }
   }
 
   if ((keyManager = createKeyManagerWithSingleKey(
@@ -100,11 +125,25 @@ VALUE encrypt_with_key(VALUE self, VALUE rb_rsa_key_name, VALUE rb_rsa_key,
     goto done;
   }
 
+  if(certificate) {
+    // load certificate and add to the key
+    if(xmlSecCryptoAppKeyCertLoadMemory(encCtx->encKey,
+                                        (xmlSecByte *)certificate,
+                                        certificateLength,
+                                        xmlSecKeyDataFormatPem) < 0) {
+      rb_exception_result = rb_eSigningError;
+      exception_message = "failed to load certificate";
+      goto done;
+    }
+  }
+
   // Set key name.
-  if(xmlSecKeySetName(encCtx->encKey, (xmlSecByte *)keyName) < 0) {
-    rb_exception_result = rb_eEncryptionError;
-    exception_message = "failed to set key name";
-    goto done;
+  if(keyName) {
+    if(xmlSecKeySetName(encCtx->encKey, (xmlSecByte *)keyName) < 0) {
+      rb_exception_result = rb_eEncryptionError;
+      exception_message = "failed to set key name";
+      goto done;
+    }
   }
 
   // Add <enc:EncryptedKey/> node to the <dsig:KeyInfo/> tag to include
@@ -127,7 +166,7 @@ VALUE encrypt_with_key(VALUE self, VALUE rb_rsa_key_name, VALUE rb_rsa_key,
   }
 
   // encrypt the data
-  if(xmlSecEncCtxXmlEncrypt(encCtx, encDataNode, xmlDocGetRootElement(doc)) < 0) {
+  if(xmlSecEncCtxXmlEncrypt(encCtx, encDataNode, node) < 0) {
     rb_exception_result = rb_eEncryptionError;
     exception_message = "encryption failed";
     goto done;

data/ext/nokogiri_ext_xmlsec/nokogiri_helpers_set_attribute_id.c

@@ -1,9 +1,6 @@
 #include "xmlsecrb.h"
 #include "util.h"
 
-// declaration from Nokogiri proper
-VALUE Nokogiri_wrap_xml_node(VALUE klass, xmlNodePtr node) ;
-
 VALUE set_id_attribute(VALUE self, VALUE rb_attr_name) {
   VALUE rb_exception_result = Qnil;
   const char* exception_message = NULL;
@@ -14,10 +11,10 @@ VALUE set_id_attribute(VALUE self, VALUE rb_attr_name) {
   xmlChar *name = NULL;
   char *idName = NULL;
   char *exception_attribute_arg = NULL;
-  
+
   resetXmlSecError();
 
-  Data_Get_Struct(self, xmlNode, node);
+  Noko_Node_Get_Struct(self, xmlNode, node);
   Check_Type(rb_attr_name, T_STRING);
   idName = StringValueCStr(rb_attr_name);
 
@@ -28,7 +25,7 @@ VALUE set_id_attribute(VALUE self, VALUE rb_attr_name) {
     exception_message = "Can't find attribute to add register as id";
     goto done;
   }
-  
+
   // get the attribute (id) value
   name = xmlNodeListGetString(node->doc, attr->children, 1);
   if(name == NULL) {
@@ -37,7 +34,7 @@ VALUE set_id_attribute(VALUE self, VALUE rb_attr_name) {
     exception_attribute_arg = idName;
     goto done;
   }
-  
+
   // check that we don't have that id already registered
   tmp = xmlGetID(node->doc, name);
   if(tmp != NULL) {
@@ -46,7 +43,7 @@ VALUE set_id_attribute(VALUE self, VALUE rb_attr_name) {
     exception_attribute_arg = idName;
     goto done;
   }
-  
+
   // finally register id
   xmlAddID(NULL, node->doc, name, attr);
 
@@ -86,10 +83,10 @@ VALUE get_id(VALUE self, VALUE rb_id)
   xmlDocPtr doc;
 
   Check_Type(rb_id, T_STRING);
-  Data_Get_Struct(self, xmlDoc, doc);
+  Noko_Node_Get_Struct(self, xmlDoc, doc);
   prop = xmlGetID(doc, (const xmlChar *)StringValueCStr(rb_id));
   if (prop) {
-    return Nokogiri_wrap_xml_node(Qnil, (xmlNodePtr)prop);
+    return noko_xml_node_wrap(Qnil, (xmlNodePtr)prop);
   } else {
     return Qnil;
   }

data/ext/nokogiri_ext_xmlsec/nokogiri_init.c

@@ -17,7 +17,7 @@ void Init_Nokogiri_ext() {
 
   rb_define_method(rb_cNokogiri_XML_Node,     "sign!",            sign, 1);
   rb_define_method(rb_cNokogiri_XML_Node,     "verify_with",      verify_with, 1);
-  rb_define_method(rb_cNokogiri_XML_Document, "encrypt_with_key", encrypt_with_key, 3);
+  rb_define_method(rb_cNokogiri_XML_Node,     "encrypt_with_key", encrypt_with_key, 3);
   rb_define_method(rb_cNokogiri_XML_Node,     "decrypt_with_key", decrypt_with_key, 2);
   rb_define_method(rb_cNokogiri_XML_Document, "get_id",           get_id, 1);
   rb_define_method(rb_cNokogiri_XML_Node,     "set_id_attribute", set_id_attribute, 1);

data/ext/nokogiri_ext_xmlsec/nokogiri_sign.c

@@ -90,7 +90,7 @@ VALUE sign(VALUE self, VALUE rb_opts) {
     goto done;
   }
 
-  Data_Get_Struct(self, xmlNode, envelopeNode);
+  Noko_Node_Get_Struct(self, xmlNode, envelopeNode);
   doc = envelopeNode->doc;
   // create signature template for enveloped signature.
   signNode = xmlSecTmplSignatureCreate(doc, xmlSecTransformExclC14NId,

data/ext/nokogiri_ext_xmlsec/nokogiri_verify_with.c

@@ -146,7 +146,7 @@ VALUE verify_with(VALUE self, VALUE rb_opts) {
   resetXmlSecError();
 
   Check_Type(rb_opts, T_HASH);
-  Data_Get_Struct(self, xmlNode, node);
+  Noko_Node_Get_Struct(self, xmlNode, node);
 
   // verify start node
   if(!xmlSecCheckNodeName(node, xmlSecNodeSignature, xmlSecDSigNs)) {

data/ext/nokogiri_ext_xmlsec/xmlsecrb.h

@@ -20,6 +20,12 @@
 #include <xmlsec/crypto.h>
 #include <xmlsec/errors.h>
 
+#include <nokogiri.h>
+// Lifted from modern nokogiri.h
+#ifndef Noko_Node_Get_Struct
+  #define Noko_Node_Get_Struct(obj,type,sval) ((sval) = (type*)DATA_PTR(obj))
+#endif
+
 // TODO(awong): Support non-gcc and non-clang compilers.
 #define EXTENSION_EXPORT __attribute__((visibility("default")))
 

data/gemfiles/nokogiri_12.5.gemfile

@@ -0,0 +1,7 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "nokogiri", "1.12.5"
+
+gemspec path: "../"

data/gemfiles/nokogiri_13.10.gemfile

@@ -0,0 +1,7 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "nokogiri", "1.13.10"
+
+gemspec path: "../"

data/lib/xmlsec/version.rb

@@ -1,3 +1,3 @@
 module Xmlsec
-  VERSION = '0.9.6'
+  VERSION = '0.10.2'
 end

data/lib/xmlsec.rb

@@ -61,12 +61,8 @@ class Nokogiri::XML::Document
   #     # encrypt with a public key and optional key name
   #     doc.encrypt! key: 'public-key', name: 'name'
   #
-  def encrypt! opts
-    if opts[:key]
-      encrypt_with_key opts[:name].to_s, opts[:key], opts.select { |key, _| key != :key && key != :name }
-    else
-      raise "public :key is required for encryption"
-    end
+  def encrypt!(key:, name: nil, **opts)
+    root.encrypt_with(key: key, name: name, **opts)
     self
   end
 
@@ -89,6 +85,11 @@ class Nokogiri::XML::Document
 end
 
 class Nokogiri::XML::Node
+  def encrypt_with(key:, name: nil, **opts)
+    raise ArgumentError("public :key is required for encryption") unless key
+    encrypt_with_key(name, key, opts)
+  end
+
   def decrypt_with(opts)
     raise 'inadequate options specified for decryption' unless opts[:key]
 

data/nokogiri-xmlsec-instructure.gemspec

@@ -28,9 +28,11 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
   spec.extensions = %w{ext/nokogiri_ext_xmlsec/extconf.rb}
 
-  spec.add_dependency 'nokogiri'
-  
-  spec.add_development_dependency "bundler", "~> 1.3"
+  spec.add_dependency 'nokogiri', '>= 1.11.2'
+
+  spec.add_development_dependency "appraisal"
+  spec.add_development_dependency "bundler", "~> 2.1"
+  spec.add_development_dependency "byebug"
   spec.add_development_dependency "rake"
   spec.add_development_dependency "rake-compiler"
   spec.add_development_dependency "rspec"

data/spec/lib/nokogiri/xml/document/encryption_and_decryption_spec.rb

@@ -31,4 +31,25 @@ describe "encryption and decryption:" do
     end
   end
 
+  it "encrypts a single element" do
+    doc = subject
+    original = doc.to_s
+    node = doc.at_xpath('env:Envelope/env:Data', 'env' => 'urn:envelope')
+    node.encrypt_with(key: fixture('rsa.pub'), block_encryption: 'aes128-cbc', key_transport: 'rsa-1_5')
+    expect(doc.root.name).to eq 'Envelope'
+    expect(doc.root.element_children.first.name).to eq 'EncryptedData'
+    encrypted_data = doc.root.element_children.first
+    encrypted_data.decrypt_with(key: fixture('rsa.pem'))
+    expect(doc.to_s).to eq original
+  end
+
+  it "inserts a certificate" do
+    doc = subject
+    doc.encrypt!(key: fixture('cert/server.key.decrypted'),
+                 cert: fixture('cert/server.crt'),
+                 block_encryption: 'aes128-cbc',
+                 key_transport: 'rsa-1_5')
+    expect(doc.to_s).to match(/X509Data/)
+    expect(doc.to_s).not_to match(/X509Data></)
+  end
 end

metadata

@@ -1,15 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: nokogiri-xmlsec-instructure
 version: !ruby/object:Gem::Version
-  version: 0.9.6
+  version: 0.10.2
 platform: ruby
 authors:
 - Albert J. Wong
 - Cody Cutrer
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2018-05-10 00:00:00.000000000 Z
+date: 2022-12-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri
@@ -17,9 +17,23 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 1.11.2
   type: :runtime
   prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.11.2
+- !ruby/object:Gem::Dependency
+  name: appraisal
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -31,14 +45,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '2.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
+        version: '2.1'
+- !ruby/object:Gem::Dependency
+  name: byebug
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -126,9 +154,11 @@ extensions:
 - ext/nokogiri_ext_xmlsec/extconf.rb
 extra_rdoc_files: []
 files:
+- ".github/workflows/push.yml"
 - ".gitignore"
 - ".rspec"
-- ".travis.yml"
+- ".tool-versions"
+- Appraisals
 - Gemfile
 - Guardfile
 - LICENSE.txt
@@ -149,6 +179,8 @@ files:
 - ext/nokogiri_ext_xmlsec/util.c
 - ext/nokogiri_ext_xmlsec/util.h
 - ext/nokogiri_ext_xmlsec/xmlsecrb.h
+- gemfiles/nokogiri_12.5.gemfile
+- gemfiles/nokogiri_13.10.gemfile
 - lib/nokogiri-xmlsec.rb
 - lib/xmlsec.rb
 - lib/xmlsec/version.rb
@@ -172,7 +204,7 @@ homepage: https://github.com/instructure/nokogiri-xmlsec-instructure
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -187,9 +219,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6
-signing_key: 
+rubygems_version: 3.2.33
+signing_key:
 specification_version: 4
 summary: Wrapper around http://www.aleksey.com/xmlsec to support XML encryption, decryption,
   signing and signature validation in Ruby

data/.travis.yml

@@ -1,3 +0,0 @@
-before_install:
-  - sudo apt-get update -qq
-  - sudo apt-get install -y libxmlsec1-dev