Prevent duplicate parsing and use async crypto #11
Conversation
lib/signed-xml.js
Outdated
| signer.verifySignature(signedInfoCanon, this.signingKey, this.signatureValue, (err, res) => { | ||
| if (err || !res) { | ||
| this.validationErrors.push("invalid signature: the signature value " + | ||
| this.signatureValue + " is incorrect") |
There was a problem hiding this comment.
Needs to be this.signatureValue.toString('base64') now we're using a buffer instead of string.
lib/signed-xml.js
Outdated
|
|
||
| return true | ||
| return await this.validateSignatureValue(doc); |
There was a problem hiding this comment.
You don't strictly need the await here do you? Does it cause an extra entry on the micro task queue?
| signer.verifySignature(signedInfoCanon, this.signingKey, this.signatureValue, (err, res) => { | ||
| if (err || !res) { | ||
| this.validationErrors.push("invalid signature: the signature value " + | ||
| this.signatureValue.toString('base64') + " is incorrect") |
There was a problem hiding this comment.
Is it possible for this function to be invoked when this.signatureValue is not defined or is null, which would cause toString to fail?
There was a problem hiding this comment.
Yes, but you wouldn't. This function is meant to be an internal function of checkSignature.
Possible, yes, based on misuse.
| @@ -917,7 +923,7 @@ SignedXml.prototype.createSignature = function(prefix) { | |||
| prefix = ''; | |||
| } | |||
|
|
|||
| var signatureValueXml = "<" + prefix + "SignatureValue>" + this.signatureValue + "</" + prefix + "SignatureValue>" | |||
| var signatureValueXml = "<" + prefix + "SignatureValue>" + this.signatureValue.toString('base64') + "</" + prefix + "SignatureValue>" | |||
There was a problem hiding this comment.
Is it possible for this.signatureValue to be undefined or null which would cause toString to fail?
There was a problem hiding this comment.
Similar to above. createSignature is an internal method of computeSignature. Note that the documentation is just the README for "public" methods but those are the ones meant to be used by consumers to have proper usage of the library.
By submitting a PR to this repository, you agree to the terms within the Auth0 Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.
Description
References
Testing
Checklist