Release 2.1.1. Security release for CVE-2019-3465

CHANGELOG.txt

@@ -1,5 +1,12 @@
 xmlseclibs.php
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+06, Nov 2019, 2.1.1
+Security Improvements:
+- Insure only a single SignedInfo element exists within a signature during 
+  verification. Refs CVE-2019-3465.
+Bug Fixes:
+- Fix variable casing.
+
 15, Nov 2018, 2.1.0
 Security Improvements:
 - Filter input to avoid XPath injection. (Jaime Pérez)

LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2007-2018, Robert Richards <[email protected]>.
+Copyright (c) 2007-2019, Robert Richards <[email protected]>.
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

src/XMLSecurityDSig.php

@@ -194,6 +194,11 @@ public function locateSignature($objDoc, $pos=0)
             $query = ".//secdsig:Signature";
             $nodeset = $xpath->query($query, $objDoc);
             $this->sigNode = $nodeset->item($pos);
+            $query = "./secdsig:SignedInfo";
+            $nodeset = $xpath->query($query, $this->sigNode);
+            if ($nodeset->length > 1) {
+                throw new Exception("Invalid structure - Too many SignedInfo elements found");
+            }
             return $this->sigNode;
         }
         return null;
@@ -234,6 +239,9 @@ public function setCanonicalMethod($method)
         if ($xpath = $this->getXPathObj()) {
             $query = './'.$this->searchpfx.':SignedInfo';
             $nodeset = $xpath->query($query, $this->sigNode);
+            if ($nodeset->length > 1) {
+                throw new Exception("Invalid structure - Too many SignedInfo elements found");
+            }
             if ($sinfo = $nodeset->item(0)) {
                 $query = './'.$this->searchpfx.'CanonicalizationMethod';
                 $nodeset = $xpath->query($query, $sinfo);
@@ -440,7 +448,7 @@ public function processTransforms($refNode, $objData, $includeCommentNodes = tru
                         if ($node->localName == 'XPath') {
                             $arXPath = array();
                             $arXPath['query'] = '(.//. | .//@* | .//namespace::*)['.$node->nodeValue.']';
-                            $arXpath['namespaces'] = array();
+                            $arXPath['namespaces'] = array();
                             $nslist = $xpath->query('./namespace::*', $node);
                             foreach ($nslist AS $nsnode) {
                                 if ($nsnode->localName != "xml") {
@@ -554,7 +562,7 @@ public function getRefIDs()
         $refids = array();
 
         $xpath = $this->getXPathObj();
-        $query = "./secdsig:SignedInfo/secdsig:Reference";
+        $query = "./secdsig:SignedInfo[1]/secdsig:Reference";
         $nodeset = $xpath->query($query, $this->sigNode);
         if ($nodeset->length == 0) {
             throw new Exception("Reference nodes not found");

xmlseclibs.php

@@ -2,7 +2,7 @@
 /**
  * xmlseclibs.php
  *
- * Copyright (c) 2007-2018, Robert Richards <[email protected]>.
+ * Copyright (c) 2007-2019, Robert Richards <[email protected]>.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -35,9 +35,9 @@
  * POSSIBILITY OF SUCH DAMAGE.
  *
  * @author    Robert Richards <[email protected]>
- * @copyright 2007-2018 Robert Richards <[email protected]>
+ * @copyright 2007-2019 Robert Richards <[email protected]>
  * @license   http://www.opensource.org/licenses/bsd-license.php  BSD License
- * @version   2.1.0
+ * @version   2.1.1
  */
 
 $xmlseclibs_srcdir = dirname(__FILE__) . '/src/';