xml-kit 0.1.14 → 0.5.0

data/lib/xml/kit/self_signed_certificate.rb

@@ -3,9 +3,11 @@
 module Xml
   module Kit
     class SelfSignedCertificate
-      SUBJECT = '/C=CA/ST=AB/L=Calgary/O=XmlKit/OU=XmlKit/CN=XmlKit'.freeze
+      SUBJECT = '/C=CA/ST=AB/L=Calgary/O=XmlKit/OU=XmlKit/CN=XmlKit'
 
-      def create(algorithm: 'AES-256-CBC', passphrase: nil, key_pair: OpenSSL::PKey::RSA.new(2048))
+      def create(algorithm: 'AES-256-CBC',
+                 passphrase: nil,
+                 key_pair: OpenSSL::PKey::RSA.new(2048))
         certificate = certificate_for(key_pair.public_key)
         certificate.sign(key_pair, OpenSSL::Digest::SHA256.new)
         [certificate.to_pem, export(key_pair, algorithm, passphrase)]
@@ -24,14 +26,25 @@ module Xml
 
       def certificate_for(public_key)
         certificate = OpenSSL::X509::Certificate.new
-        certificate.subject = certificate.issuer = OpenSSL::X509::Name.parse(SUBJECT)
+        certificate.subject =
+          certificate.issuer = OpenSSL::X509::Name.parse(SUBJECT)
         certificate.not_before = Time.now
         certificate.not_after = certificate.not_before + 30 * 24 * 60 * 60 # 30 days
         certificate.public_key = public_key
         certificate.serial = 0x0
         certificate.version = 2
+        apply_ski_extension_to(certificate)
         certificate
       end
+
+      def apply_ski_extension_to(certificate)
+        extensions = OpenSSL::X509::ExtensionFactory.new
+        extensions.subject_certificate = certificate
+        extensions.issuer_certificate = certificate
+        certificate.add_extension(
+          extensions.create_extension('subjectKeyIdentifier', 'hash', false)
+        )
+      end
     end
   end
 end

data/lib/xml/kit/signature.rb

@@ -2,6 +2,10 @@
 
 module Xml
   module Kit
+    # An implementation of the Signature element.
+    # https://www.w3.org/TR/xmldsig-core1/#sec-Signature
+    #
+    # @since 0.1.0
     class Signature
       SIGNATURE_METHODS = {
         SHA1: 'http://www.w3.org/2000/09/xmldsig#rsa-sha1',
@@ -11,7 +15,7 @@ module Xml
         SHA512: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512',
       }.freeze
       DIGEST_METHODS = {
-        SHA1: 'http://www.w3.org/2000/09/xmldsig#SHA1',
+        SHA1: 'http://www.w3.org/2000/09/xmldsig#sha1',
         SHA224: 'http://www.w3.org/2001/04/xmldsig-more#sha224',
         SHA256: 'http://www.w3.org/2001/04/xmlenc#sha256',
         SHA384: 'http://www.w3.org/2001/04/xmldsig-more#sha384',
@@ -23,7 +27,10 @@ module Xml
       attr_reader :reference_id
       attr_reader :signature_method
 
-      def initialize(reference_id, signature_method: :SH256, digest_method: :SHA256, certificate:)
+      def initialize(reference_id,
+                     signature_method: :SH256,
+                     digest_method: :SHA256,
+                     certificate:)
         @certificate = certificate
         @digest_method = DIGEST_METHODS[digest_method]
         @reference_id = reference_id

data/lib/xml/kit/signatures.rb

@@ -39,7 +39,10 @@ module Xml
       end
 
       # @!visibility private
-      def self.sign(xml: ::Builder::XmlMarkup.new, key_pair:, signature_method: :SHA256, digest_method: :SHA256)
+      def self.sign(xml: ::Builder::XmlMarkup.new,
+                    key_pair:,
+                    signature_method: :SHA256,
+                    digest_method: :SHA256)
         signatures = new(
           key_pair: key_pair,
           signature_method: signature_method,

data/lib/xml/kit/templatable.rb

@@ -17,22 +17,79 @@ module Xml
       # The [Xml::Kit::Certificate] that contains the public key to use for encrypting the document.
       attr_accessor :encryption_certificate
 
+      # Allows you to specify the digest method algorithm. (Default: SHA256)
+      # A list of digest methods can be found in [Xml::Kit::Signature].
+      attr_accessor :digest_method
+
+      # Allows you to specify the signature method algorithm. (Default: SHA256)
+      # A list of signature methods can be found in [Xml::Kit::Signature].
+      attr_accessor :signature_method
+
       # Returns the generated XML document with an XML Digital Signature and XML Encryption.
-      def to_xml(xml: ::Builder::XmlMarkup.new)
-        signatures.complete(render(self, xml: xml))
+      def to_xml(xml: ::Builder::XmlMarkup.new, pretty: false)
+        result = signatures.complete(render(self, xml: xml))
+        pretty ? Nokogiri::XML(result).to_xml(indent: 2) : result
+      end
+
+      # Generates an {#Xml::Kit::EncryptedKey} section. https://www.w3.org/TR/xmlenc-core1/#sec-EncryptedKey
+      #
+      # @since 0.3.0
+      # @param xml [Builder::XmlMarkup] the xml builder instance
+      # @param id [String] the id of EncryptedKey element
+      def encrypt_key_for(xml:, id:, key_info: nil)
+        ::Xml::Kit::EncryptedKey.new(
+          id: id,
+          asymmetric_cipher: asymmetric_cipher,
+          symmetric_cipher: symmetric_cipher,
+          key_info: key_info
+        ).to_xml(xml: xml)
+      end
+
+      # @deprecated Use {#encrypt_data_for} instead of this
+      def encryption_for(*args, &block)
+        ::Xml::Kit.deprecate(
+          'encryption_for is deprecated. Use encrypt_data_for instead.'
+        )
+        encrypt_data_for(*args, &block)
+      end
+
+      # Generates an {#Xml::Kit::EncryptedData} section. https://www.w3.org/TR/xmlenc-core1/#sec-EncryptedData
+      #
+      # @since 0.3.0
+      # @param xml [Builder::XmlMarkup] the xml builder instance
+      # @param key_info [Xml::Kit::KeyInfo] the key info to render in the EncryptedData
+      def encrypt_data_for(xml:, key_info: nil)
+        return yield xml unless encrypt?
+
+        temp = ::Builder::XmlMarkup.new
+        yield temp
+        ::Xml::Kit::EncryptedData.new(
+          signatures.complete(temp.target!),
+          symmetric_cipher: symmetric_cipher,
+          asymmetric_cipher: asymmetric_cipher,
+          key_info: key_info
+        ).to_xml(xml: xml)
+      end
+
+      # Provides a default RSA asymmetric cipher. Can be overridden to provide custom ciphers.
+      #
+      # @abstract
+      # @since 0.3.0
+      def asymmetric_cipher(algorithm: Crypto::RsaCipher::ALGORITHM)
+        raise Xml::Kit::Error, 'encryption_certificate is not specified.' unless encryption_certificate
+
+        @asymmetric_cipher ||= Crypto.cipher_for(
+          algorithm,
+          encryption_certificate.public_key
+        )
       end
 
-      def encryption_for(xml:)
-        if encrypt?
-          temp = ::Builder::XmlMarkup.new
-          yield temp
-          ::Xml::Kit::Encryption.new(
-            signatures.complete(temp.target!),
-            encryption_certificate.public_key
-          ).to_xml(xml: xml)
-        else
-          yield xml
-        end
+      # Provides a default aes256-cbc symmetric cipher. Can be overridden to provide custom ciphers.
+      #
+      # @abstract
+      # @since 0.3.0
+      def symmetric_cipher
+        @symmetric_cipher ||= Crypto::SymmetricCipher.new
       end
 
       def render(model, options)
@@ -48,9 +105,11 @@ module Xml
       # Allows you to specify which key pair to use for generating an XML digital signature.
       #
       # @param key_pair [Xml::Kit::KeyPair] the key pair to use for signing.
-      def sign_with(key_pair)
+      def sign_with(key_pair, signature_method: :SHA256, digest_method: :SHA256)
         self.signing_key_pair = key_pair
         self.embed_signature = true
+        self.signature_method = signature_method
+        self.digest_method = digest_method
         signatures.sign_with(key_pair)
       end
 
@@ -72,19 +131,11 @@ module Xml
       def signatures
         @signatures ||= ::Xml::Kit::Signatures.new(
           key_pair: signing_key_pair,
-          digest_method: digest_method,
-          signature_method: signature_method
+          digest_method: digest_method || :SHA256,
+          signature_method: signature_method || :SHA256
         )
       end
 
-      def digest_method
-        :SHA256
-      end
-
-      def signature_method
-        :SHA256
-      end
-
       # @!visibility private
       def encrypt?
         encrypt && encryption_certificate

data/lib/xml/kit/templates/certificate.builder

@@ -1,9 +1,5 @@
 # frozen_string_literal: true
 
 xml.KeyDescriptor use ? { use: use } : {} do
-  xml.KeyInfo "xmlns": ::Xml::Kit::Namespaces::XMLDSIG do
-    xml.X509Data do
-      xml.X509Certificate stripped
-    end
-  end
+  render key_info, xml: xml
 end

data/lib/xml/kit/templates/encrypted_data.builder

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+xml.EncryptedData xmlns: ::Xml::Kit::Namespaces::XMLENC do
+  xml.EncryptionMethod Algorithm: symmetric_cipher.algorithm
+  render key_info, xml: xml
+  xml.CipherData do
+    xml.CipherValue symmetric_cipher_value
+  end
+end

data/lib/xml/kit/templates/encrypted_key.builder

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+xml.EncryptedKey Id: id, xmlns: ::Xml::Kit::Namespaces::XMLENC do
+  xml.EncryptionMethod Algorithm: asymmetric_cipher.algorithm
+  render(key_info, xml: xml) if key_info
+  xml.CipherData do
+    xml.CipherValue cipher_value
+  end
+end

data/lib/xml/kit/templates/key_info.builder

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+xml.KeyInfo xmlns: ::Xml::Kit::Namespaces::XMLDSIG do
+  xml.KeyName key_name if key_name
+  render(key_value, xml: xml) if @key_value
+  render(retrieval_method, xml: xml) if @retrieval_method
+  if x509_data
+    xml.X509Data do
+      xml.X509SKI subject_key_identifier
+      xml.X509Certificate ::Xml::Kit::Certificate.strip(x509_data.to_pem)
+    end
+  end
+  render(encrypted_key, xml: xml) if encrypted_key
+end

data/lib/xml/kit/templates/key_value.builder

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+xml.KeyValue do
+  render(rsa, xml: xml) if @rsa
+end

data/lib/xml/kit/templates/retrieval_method.builder

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+xml.RetrievalMethod xmlns: ::Xml::Kit::Namespaces::XMLDSIG, URI: uri, Type: type

data/lib/xml/kit/templates/rsa_key_value.builder

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+xml.RSAKeyValue do
+  xml.Modulus modulus
+  xml.Exponent exponent
+end

data/lib/xml/kit/templates/signature.builder

@@ -6,7 +6,7 @@ xml.Signature 'xmlns' => ::Xml::Kit::Namespaces::XMLDSIG do
     xml.SignatureMethod Algorithm: signature_method
     xml.Reference URI: "##{reference_id}" do
       xml.Transforms do
-        xml.Transform Algorithm: "#{::Xml::Kit::Namespaces::XMLDSIG}enveloped-signature"
+        xml.Transform Algorithm: ::Xml::Kit::Namespaces::ENVELOPED_SIG
         xml.Transform Algorithm: ::Xml::Kit::Namespaces::CANONICALIZATION
       end
       xml.DigestMethod Algorithm: digest_method

data/lib/xml/kit/version.rb

@@ -2,6 +2,6 @@
 
 module Xml
   module Kit
-    VERSION = '0.1.14'.freeze
+    VERSION = '0.5.0'
   end
 end

data/xml-kit.gemspec

@@ -14,7 +14,7 @@ Gem::Specification.new do |spec|
   spec.description   = 'A simple toolkit for working with XML.'
   spec.homepage      = 'https://github.com/saml-kit/xml-kit'
   spec.license       = 'MIT'
-  spec.required_ruby_version = '>= 2.2.0'
+  spec.required_ruby_version = Gem::Requirement.new('>= 2.5.0')
 
   spec.files = `git ls-files -z`.split("\x0").reject do |f|
     f.match(%r{^(test|spec|features)/})
@@ -26,13 +26,13 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency 'activemodel', '>= 4.2.0'
   spec.add_dependency 'builder', '~> 3.2'
-  spec.add_dependency 'nokogiri', '>= 1.8.5'
+  spec.add_dependency 'nokogiri', '~> 1.10'
   spec.add_dependency 'tilt', '>= 1.4.1'
   spec.add_dependency 'xmldsig', '~> 0.6'
-  spec.add_development_dependency 'bundler', '~> 1.16'
+  spec.add_development_dependency 'bundler', '~> 2.0'
   spec.add_development_dependency 'bundler-audit', '~> 0.6'
   spec.add_development_dependency 'ffaker', '~> 2.7'
-  spec.add_development_dependency 'rake', '~> 10.0'
+  spec.add_development_dependency 'rake', '~> 13.0'
   spec.add_development_dependency 'rspec', '~> 3.0'
   spec.add_development_dependency 'rubocop', '~> 0.52'
   spec.add_development_dependency 'rubocop-rspec', '~> 1.22'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: xml-kit
 version: !ruby/object:Gem::Version
-  version: 0.1.14
+  version: 0.5.0
 platform: ruby
 authors:
 - mo khan
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2018-11-21 00:00:00.000000000 Z
+date: 2021-01-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activemodel
@@ -42,16 +42,16 @@ dependencies:
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.8.5
+        version: '1.10'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.8.5
+        version: '1.10'
 - !ruby/object:Gem::Dependency
   name: tilt
   requirement: !ruby/object:Gem::Requirement
@@ -86,14 +86,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.16'
+        version: '2.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.16'
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: bundler-audit
   requirement: !ruby/object:Gem::Requirement
@@ -128,14 +128,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '13.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '13.0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -203,9 +203,10 @@ files:
 - ".gitlab-ci.yml"
 - ".rspec"
 - ".rubocop.yml"
-- ".rubocop_todo.yml"
 - ".travis.yml"
+- CHANGELOG.md
 - Gemfile
+- Gemfile.lock
 - LICENSE.txt
 - README.md
 - Rakefile
@@ -225,9 +226,15 @@ files:
 - lib/xml/kit/decryption.rb
 - lib/xml/kit/decryption_error.rb
 - lib/xml/kit/document.rb
+- lib/xml/kit/encrypted_data.rb
+- lib/xml/kit/encrypted_key.rb
 - lib/xml/kit/encryption.rb
 - lib/xml/kit/fingerprint.rb
 - lib/xml/kit/id.rb
+- lib/xml/kit/key_info.rb
+- lib/xml/kit/key_info/key_value.rb
+- lib/xml/kit/key_info/retrieval_method.rb
+- lib/xml/kit/key_info/rsa_key_value.rb
 - lib/xml/kit/key_pair.rb
 - lib/xml/kit/namespaces.rb
 - lib/xml/kit/self_signed_certificate.rb
@@ -236,8 +243,13 @@ files:
 - lib/xml/kit/templatable.rb
 - lib/xml/kit/template.rb
 - lib/xml/kit/templates/certificate.builder
-- lib/xml/kit/templates/encryption.builder
+- lib/xml/kit/templates/encrypted_data.builder
+- lib/xml/kit/templates/encrypted_key.builder
+- lib/xml/kit/templates/key_info.builder
+- lib/xml/kit/templates/key_value.builder
 - lib/xml/kit/templates/nil_class.builder
+- lib/xml/kit/templates/retrieval_method.builder
+- lib/xml/kit/templates/rsa_key_value.builder
 - lib/xml/kit/templates/signature.builder
 - lib/xml/kit/version.rb
 - xml-kit.gemspec
@@ -246,7 +258,7 @@ licenses:
 - MIT
 metadata:
   yard.run: yri
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -254,16 +266,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.2.0
+      version: 2.5.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6
-signing_key: 
+rubygems_version: 3.2.3
+signing_key:
 specification_version: 4
 summary: A simple toolkit for working with XML.
 test_files: []