Harden XMLSecurityDSig after static analysis

Close SSRF via IPv4-mapped IPv6, fail closed on unknown transforms, tighten same-document Reference URIs, and fix enveloped-signature / Object C14N handling without always detaching Signature from the caller DOM.

Author: robrichards

CHANGELOG.txt

@@ -7,11 +7,38 @@ Features:
   support the URI fragment)
 - Change selected XMLSecurityDSig private properties and methods to protected
   so the class can be extended (gdespirito). refs #152
+- Add XMLSecurityDSig::ENVELOPED constant for the enveloped-signature Transform
+  URI; deprecate empty appendCert() stub (use add509Cert())
 
 Security Improvements:
 - Harden add509Cert() URL fetching against SSRF: only http/https by default
   (file:// requires options['allow_file_scheme']); resolve the host and reject
   loopback/private/link-local/reserved/CGNAT addresses; disable HTTP redirects
+- Reject IPv4-mapped / IPv4-compatible IPv6 certificate URL hosts (e.g.
+  ::ffff:127.0.0.1, ::ffff:169.254.169.254): unwrap the embedded IPv4 and apply
+  the same private/reserved/CGNAT checks (PHP's FILTER_FLAG_NO_* treats mapped
+  addresses as public)
+- Fail closed on unknown Reference Transform algorithms; recognize
+  enveloped-signature explicitly. validateReference() no longer always detaches
+  the Signature from the caller DOM (that broke C14N of ds:Object targets and
+  left half-mutated trees on failure); enveloped-signature removes Signature
+  only when it is a proper descendant of the node being digested
+- Tighten same-document Reference URIs to empty URI and "#id" only (reject
+  "?query", bare "#", and external URIs); share parsing between processRefNode()
+  and getRefNodeID(). Same-document refs always omit comments
+- Reject hostile idKeys attribute names (no whitespace / XPath operators) via
+  Utils\XPath::filterAttrName; invalid names throw
+- Reject duplicate CanonicalizationMethod / SignatureMethod under SignedInfo and
+  duplicate DigestMethod / DigestValue / SignatureValue during verify
+- Reset the cached DOMXPath in locateSignature() so instance reuse across
+  documents cannot fatal with "Node from wrong document"
+- verifyDocument() no longer permanently overwrites instance algorithm
+  allowlists (restored in finally)
+- addReference() / addReferenceList() / sign() / add509Cert() throw instead of
+  silently no-oping when SignedInfo / signature context is missing; sign()
+  requires setCanonicalMethod() and a SignatureMethod element
+- Require correct namespace URIs for InclusiveNamespaces (exc-c14n) and XPath
+  transform children (not localName alone)
 - Reject a DOCTYPE in decrypted XML (defense against entity-expansion / XXE in
   attacker-crafted encrypted content)
 - Reject a DOCTYPE in documents being signature-verified (locateSignature). Closes

src/Utils/XPath.php

@@ -9,6 +9,9 @@ class XPath
     const LETTERS = '\w';
     const EXTENDED_ALPHANUMERIC = '-\w\d\s_:\.';
 
+    /* Attribute names only — no whitespace or XPath operators. */
+    const EXTENDED_ALPHANUMERIC_STRICT = '-\w\d_:\.';
+
     const SINGLE_QUOTE = '\'';
     const DOUBLE_QUOTE = '"';
     const ALL_QUOTES = '[\'"]';
@@ -37,7 +40,7 @@ public static function filterAttrValue($value, $quotes = self::ALL_QUOTES)
      *
      * @return string The filtered attribute name.
      */
-    public static function filterAttrName($name, $allow = self::EXTENDED_ALPHANUMERIC)
+    public static function filterAttrName($name, $allow = self::EXTENDED_ALPHANUMERIC_STRICT)
     {
         return preg_replace('#[^'.$allow.']#', '', $name);
     }