Merge pull request #21 from simplesamlphp/improve-transforms

Update ds:Transforms to limit its support

Author: jaimeperez

src/XML/ds/Transform.php

@@ -5,110 +5,162 @@
 namespace SimpleSAML\XMLSecurity\XML\ds;
 
 use DOMElement;
-use SimpleSAML\Assert\Assert;
-use SimpleSAML\XML\Chunk;
-use SimpleSAML\XML\Exception\InvalidDOMElementException;
+use SimpleSAML\XMLSecurity\Constants as C;
+use SimpleSAML\XMLSecurity\XML\ec\InclusiveNamespaces;
+use Webmozart\Assert\Assert;
 
 /**
- * Class representing a ds:Transform element.
+ * Class representing transforms.
  *
  * @package simplesamlphp/xml-security
  */
-final class Transform extends AbstractDsElement
+class Transform extends AbstractDsElement
 {
-    /** @var string */
-    protected string $Algorithm;
+    /**
+     * The algorithm used for this transform.
+     *
+     * @var string
+     */
+    protected string $algorithm;
+
+    /**
+     * An XPath object.
+     *
+     * @var XPath|null
+     */
+    protected ?XPath $xpath = null;
 
-    /** @var \SimpleSAML\XML\Chunk[] */
-    protected array $elements = [];
+    /**
+     * An InclusiveNamespaces object.
+     *
+     * @var InclusiveNamespaces|null
+     */
+    protected ?InclusiveNamespaces $inclusiveNamespaces = null;
 
 
     /**
-     * Initialize a ds:Transform
+     * Initialize the Transform element.
      *
-     * @param string $Algorithm
-     * @param \SimpleSAML\XML\Chunk[] $elements
+     * @param string $algorithm
+     * @param XPath|null $xpath
+     * @param InclusiveNamespaces|null $prefixes
      */
     public function __construct(
-        string $Algorithm,
-        array $elements = []
+        string $algorithm,
+        ?XPath $xpath = null,
+        ?InclusiveNamespaces $inclusiveNamespaces = null
     ) {
-        $this->setElements($elements);
-        $this->setAlgorithm($Algorithm);
+        $this->setAlgorithm($algorithm);
+        $this->setXPath($xpath);
+        $this->setInclusiveNamespaces($inclusiveNamespaces);
     }
 
 
     /**
+     * Get the algorithm associated with this transform.
+     *
      * @return string
      */
     public function getAlgorithm(): string
     {
-        return $this->Algorithm;
+        return $this->algorithm;
     }
 
 
     /**
-     * @param string $Algorithm
-     * @throws \SimpleSAML\Assert\AssertionFailedException
+     * Set the value of the algorithm property.
+     *
+     * @param string $algorithm
      */
-    protected function setAlgorithm(string $Algorithm): void
+    private function setAlgorithm(string $algorithm): void
     {
-        Assert::notEmpty($Algorithm, 'Cannot set an empty algorithm in ' . static::NS_PREFIX . ':Transform.');
-        $this->Algorithm = $Algorithm;
+        $this->algorithm = $algorithm;
     }
 
 
     /**
-     * Collect the elements
+     * Get the XPath associated with this transform.
      *
-     * @return \SimpleSAML\XML\Chunk[]
+     * @return XPath|null
      */
-    public function getElements(): array
+    public function getXPath(): ?XPath
     {
-        return $this->elements;
+        return $this->xpath;
     }
 
 
     /**
-     * Set the value of the elements-property
+     * Set and validate the XPath object.
      *
-     * @param \SimpleSAML\XML\Chunk[] $elements
-     * @throws \SimpleSAML\Assert\AssertionFailedException if the supplied array contains anything other than Chunk objects
+     * @param XPath|null $XPath
      */
-    private function setElements(array $elements): void
+    private function setXPath(?XPath $xpath): void
     {
-        Assert::allIsInstanceOf($elements, Chunk::class);
-
-        $this->elements = $elements;
+        if ($xpath === null) {
+            return;
+        }
+        Assert::eq(
+            $this->algorithm,
+            C::XPATH_URI,
+            'Transform algorithm "' . C::XPATH_URI . '" required if XPath provided.'
+        );
+        $this->xpath = $xpath;
     }
 
 
     /**
-     * Convert XML into a Transform element
-     *
-     * @param \DOMElement $xml The XML element we should load
-     * @return self
+     * Get the InclusiveNamespaces associated with this transform.
      *
-     * @throws \SimpleSAML\XML\Exception\InvalidDOMElementException
-     *   If the qualified name of the supplied element is wrong
+     * @return InclusiveNamespaces|null
      */
-    public static function fromXML(DOMElement $xml): object
+    public function getInclusiveNamespaces(): ?InclusiveNamespaces
     {
-        Assert::same($xml->localName, 'Transform', InvalidDOMElementException::class);
-        Assert::same($xml->namespaceURI, Transform::NS, InvalidDOMElementException::class);
-
-        $Algorithm = self::getAttribute($xml, 'Algorithm');
+        return $this->inclusiveNamespaces;
+    }
 
-        $elements = [];
-        foreach ($xml->childNodes as $element) {
-            if (!($element instanceof DOMElement)) {
-                continue;
-            }
 
-            $elements[] = new Chunk($element);
+    /**
+     * Set and validate the InclusiveNamespaces object.
+     *
+     * @param InclusiveNamespaces|null $inclusiveNamespaces
+     */
+    private function setInclusiveNamespaces(?InclusiveNamespaces $inclusiveNamespaces)
+    {
+        if ($inclusiveNamespaces === null) {
+            return;
         }
+        Assert::oneOf(
+            $this->algorithm,
+            [
+                C::C14N_INCLUSIVE_WITH_COMMENTS,
+                C::C14N_EXCLUSIVE_WITHOUT_COMMENTS
+            ],
+            'Transform algorithm "' . C::C14N_EXCLUSIVE_WITH_COMMENTS . '" or "' .
+            C::C14N_EXCLUSIVE_WITHOUT_COMMENTS . '" required if InclusiveNamespaces provided.'
+        );
+        $this->inclusiveNamespaces = $inclusiveNamespaces;
+    }
 
-        return new self($Algorithm, $elements);
+
+    /**
+     * Convert XML into a Transform element.
+     *
+     * @param \DOMElement $xml The XML element we should load.
+     * @return self
+     */
+    public static function fromXML(DOMElement $xml): object
+    {
+        $alg = self::getAttribute($xml, 'Algorithm');
+        $xpath = XPath::getChildrenOfClass($xml);
+        Assert::maxCount($xpath, 1, 'Only one XPath element supported per Transform.');
+        $prefixes = InclusiveNamespaces::getChildrenOfClass($xml);
+        Assert::maxCount(
+            $prefixes,
+            1,
+            'Only one InclusiveNamespaces element supported per Transform.'
+        );
+
+        return new self($alg, array_pop($xpath), array_pop($prefixes));
     }
 
 
@@ -121,10 +173,20 @@ public static function fromXML(DOMElement $xml): object
     public function toXML(DOMElement $parent = null): DOMElement
     {
         $e = $this->instantiateParentElement($parent);
-        $e->setAttribute('Algorithm', $this->Algorithm);
 
-        foreach ($this->elements as $element) {
-            $e->appendChild($e->ownerDocument->importNode($element->getXML(), true));
+        $e->setAttribute('Algorithm', $this->algorithm);
+
+        switch ($this->algorithm) {
+            case C::XPATH_URI:
+                if ($this->xpath !== null) {
+                    $this->xpath->toXML($e);
+                }
+                break;
+            case C::C14N_EXCLUSIVE_WITH_COMMENTS:
+            case C::C14N_EXCLUSIVE_WITHOUT_COMMENTS:
+                if ($this->inclusiveNamespaces !== null) {
+                    $this->inclusiveNamespaces->toXML($e);
+                }
         }
 
         return $e;

src/XML/ds/XPath.php

@@ -0,0 +1,138 @@
+<?php
+
+declare(strict_types=1);
+
+namespace SimpleSAML\XMLSecurity\XML\ds;
+
+use DOMElement;
+use SimpleSAML\XML\Exception\InvalidDOMElementException;
+use Webmozart\Assert\Assert;
+
+/**
+ * Class implementing the XPath element.
+ *
+ * @package simplesamlphp/xml-security
+ */
+class XPath extends AbstractDsElement
+{
+    /**
+     * The XPath expression.
+     *
+     * @var string
+     */
+    protected string $expression;
+
+    /**
+     * A key-value array with namespaces, indexed by the prefixes used in the XPath expression.
+     *
+     * @var string[]
+     */
+    protected array $namespaces = [];
+
+
+    /**
+     * Construct an XPath element.
+     *
+     * @param string $expression The XPath expression itself.
+     * @param string[] $namespaces A key - value array with namespace definitions.
+     */
+    public function __construct(string $expression, array $namespaces = null)
+    {
+        $this->setExpression($expression);
+        $this->setNamespaces($namespaces);
+    }
+
+
+    /**
+     * Get the actual XPath expression.
+     *
+     * @return string
+     */
+    public function getExpression(): string
+    {
+        return $this->expression;
+    }
+
+
+    /**
+     * Set the xpath expression itself.
+     *
+     * @param string $expression
+     */
+    private function setExpression(string $expression): void
+    {
+        $this->expression = $expression;
+    }
+
+
+    /**
+     * Get the list of namespaces used in this XPath expression, with their corresponding prefix as
+     * the keys of each element in the array.
+     *
+     * @return string[]
+     */
+    public function getNamespaces(): array
+    {
+        return $this->namespaces;
+    }
+
+
+    /**
+     * Set the list of namespaces used in this XPath expression.
+     *
+     * @param string[] $namespaces
+     */
+    private function setNamespaces(?array $namespaces): void
+    {
+        if ($namespaces === null) {
+            return;
+        }
+        Assert::allString($namespaces);
+        Assert::allString(array_keys($namespaces));
+        $this->namespaces = $namespaces;
+    }
+
+
+    /**
+     * Convert XML into a class instance
+     *
+     * @param DOMElement $xml
+     * @return self
+     *
+     * @throws \SimpleSAML\XML\Exception\InvalidDOMElementException
+     *   If the qualified name of the supplied element is wrong
+     */
+    public static function fromXML(DOMElement $xml): object
+    {
+        Assert::same($xml->localName, 'XPath', InvalidDOMElementException::class);
+        Assert::same($xml->namespaceURI, self::NS, InvalidDOMElementException::class);
+
+        $namespaces = [];
+        $xpath = new \DOMXPath($xml->ownerDocument);
+        /** @var \DOMNode $ns */
+        foreach ($xpath->query('namespace::*', $xml) as $ns) {
+            if ($xml->getAttributeNode($ns->nodeName)) {
+                $namespaces[str_replace('xmlns:', '', $ns->nodeName)] =
+                    $xml->getAttribute($ns->nodeName);
+            }
+        }
+
+        return new self($xml->textContent, $namespaces);
+    }
+
+
+    /**
+     * @param DOMElement|null $parent
+     * @return DOMElement
+     */
+    public function toXML(DOMElement $parent = null): DOMElement
+    {
+        $e = $this->instantiateParentElement($parent);
+        $e->textContent = $this->expression;
+
+        foreach ($this->namespaces as $prefix => $namespace) {
+            $e->setAttribute('xmlns:' . $prefix, $namespace);
+        }
+        return $e;
+    }
+}