Rewrite signed elements structure

[tvdijen]

No description provided.

[codecov]

Codecov Report

Merging #2 (32ac524) into master (538c92c) will increase coverage by 7.09%.
The diff coverage is 80.95%.

@@             Coverage Diff              @@
##             master       #2      +/-   ##
============================================
+ Coverage     76.35%   83.45%   +7.09%     
+ Complexity      638      631       -7     
============================================
  Files            54       60       +6     
  Lines          1751     1819      +68     
============================================
+ Hits           1337     1518     +181     
+ Misses          414      301     -113     

[jaimeperez]

I think, in order to encourage good practices, and also to avoid any possible implementation errors (e.g. we have a signed element, and we just call getElement() to get the unsigned element without validating the signature first), the validate() method should return the actual element whose signature has been verified.

That would mean that when the signature validation fails, we should throw an exception (which is a good way to ensure the failure is noticeable, I believe), instead of returning false. It would also prevent us from having any processing security issue. We'll need support from xmlseclibs or our fork though to get this done, since verify should call fromXML() on the target class (the signable element), passing the actual, canonicalised an transformed DOM (not the original), and as far as I recall, that's not possible with xmlseclibs.

[jaimeperez]

I think this can be quite expensive. Would this be an alternative approach?

1. Require validate() before calling getValidatingCertificates(). If we call the latter first, raise an exception.
2. During validate(), if the signature validation succeeds with the given key, check if it corresponds to any of the certificates stored internally. Build a list of validating certificates with all where the passed key corresponds to them.
3. When calling getValidatingCertificates() after validate(), return the list we just built. If none of the certificates in the signature correspond to the given key, or no certificates where found, we just return an empty list.