Reject XPath Transforms on the verify path by default (GHSA-7mf5-fjj8-mvjc)

The XPath Filtering Transform evaluates a document-supplied XPath expression in
validateReference() before any signature cryptography runs, so a crafted
expression (e.g. deeply nested predicates) is a pre-authentication CPU
denial-of-service. The expression is arbitrary XPath by design and cannot be
sanitized, and the maxXPath* caps only bound the transform/namespace count, not
the cost of a single expression.

processTransforms() now refuses REC-xpath-19991116 transforms during
verification unless XMLSecurityDSig::$allowXPathTransforms is set to true. SAML
and WS-Security do not use XPath transforms, so the default breaks essentially
no one. Signing is unaffected (a new $signing flag keeps caller-supplied
transforms working). Updated xml-max-checks to opt in so it still exercises the
count/namespace caps.

Author: robrichards

CHANGELOG.txt

@@ -39,6 +39,13 @@ Security Improvements:
   so a public key is used as the HMAC secret) (GHSA-m5mw-mr39-66vp)
 - Bound EncryptedKey / RetrievalMethod resolution depth (prevents recursive
   key-reference DoS / memory exhaustion)
+- Reject XPath (REC-xpath-19991116) Transforms during verification by default
+  (GHSA-7mf5-fjj8-mvjc). The transform evaluates a document-supplied XPath
+  expression in validateReference() before any crypto runs, so a crafted
+  expression is a pre-auth CPU denial-of-service; the expression is arbitrary
+  XPath by design and cannot be sanitized. SAML / WS-Security do not use XPath
+  transforms. Opt in with XMLSecurityDSig::$allowXPathTransforms = true. Signing
+  is unaffected
 - Cap XPath transforms (max 5) and namespaces per XPath transform (max 20);
   overridable via $maxXPathTransforms / $maxXPathNamespaces
 - Fail closed on unresolved, external, and duplicate-Id Reference URIs

README.md

@@ -24,7 +24,9 @@ xmlseclibs requires PHP version 8.0 or greater. OpenSSL is optional (phpseclib i
 * Do not trust a signing certificate from `KeyInfo` alone. Load and pin trusted keys yourself.
 * By default `verifyDocument()` accepts only SHA-256/384/512 digests and RSA-SHA-256/384/512 (and RSA-PSS) signatures. To interoperate with legacy peers, widen the sets explicitly, e.g. `$objDSig->allowedSignatureAlgorithms[] = XMLSecurityKey::RSA_SHA1;`.
 * Prefer RSA-OAEP and AES-GCM for encryption. RSA-1.5 key transport is **denied by default** on decryption (Bleichenbacher risk); opt in with `$objenc->allowRSA15KeyTransport = true;` only for legacy interop. You can additionally pin exact algorithms via `$objenc->allowedKeyAlgorithms` / `$objenc->allowedDataAlgorithms` (presets: `XMLSecEnc::DEFAULT_KEY_ALGORITHMS` and `XMLSecEnc::DEFAULT_DATA_ALGORITHMS`, both authenticated/OAEP-only). Unauthenticated CBC modes remain available for interop but are malleable — prefer AES-GCM.
-* XPath transforms are capped by default (`maxXPathTransforms` / `maxXPathNamespaces`, defaults 5 and 20). Raise or lower these on the `XMLSecurityDSig` instance if your use case needs different limits.
+* XPath (`REC-xpath-19991116`) transforms are **rejected during verification by default**. They evaluate a document-supplied XPath expression in `validateReference()` before any signature crypto runs, so a crafted expression is a pre-authentication CPU denial-of-service — and the expression is arbitrary XPath by design, so it cannot be sanitized. SAML and WS-Security do not use them. Set `$objDSig->allowXPathTransforms = true` only if you must verify signatures that legitimately rely on XPath transforms and you trust the source. Signing is unaffected. When enabled, the count/namespace caps below still apply.
+
+* XPath transforms (once enabled) are capped by default (`maxXPathTransforms` / `maxXPathNamespaces`, defaults 5 and 20). Raise or lower these on the `XMLSecurityDSig` instance if your use case needs different limits.
 * `add509Cert(..., $isURL = true)` fetches over http/https only and rejects hosts that resolve to loopback/private/link-local/reserved/CGNAT addresses, with redirects disabled (SSRF hardening). `file://` is disabled unless you pass `array('allow_file_scheme' => true)` in `$options`. Only fetch certificates from trusted URLs — a small DNS-rebinding window remains.
 * Decrypted XML containing a `DOCTYPE` is rejected to guard against entity-expansion / XXE. Always load untrusted *input* documents yourself with DTD/entity processing disabled.
 

src/XMLSecurityDSig.php

@@ -127,6 +127,28 @@ class XMLSecurityDSig
      */
     public $maxXPathNamespaces = self::MAX_XPATH_NAMESPACES;
 
+    /**
+     * Allow XPath (REC-xpath-19991116) Transforms while verifying references.
+     *
+     * The XPath Filtering Transform evaluates an arbitrary, document-supplied
+     * XPath expression during validateReference() -- before any signature
+     * cryptography runs. A crafted expression (e.g. deeply nested predicates)
+     * can be evaluated at super-linear cost, giving an unauthenticated attacker
+     * a pre-auth CPU denial-of-service (GHSA-7mf5-fjj8-mvjc). The expression is
+     * an arbitrary XPath by design, so it cannot be sanitized without breaking
+     * the feature; the maxXPath* caps only bound the count, not the cost of a
+     * single expression.
+     *
+     * SAML and WS-Security do not use XPath transforms, so this defaults to
+     * false (reject them on the verification path). Set to true only if you
+     * must verify signatures that legitimately rely on XPath transforms and you
+     * trust the document source. Signing is unaffected (the transforms are
+     * caller-supplied, not attacker-controlled).
+     *
+     * @var bool
+     */
+    public $allowXPathTransforms = false;
+
     /**
      * Allowlist of acceptable SignatureMethod algorithm URIs.
      *
@@ -494,7 +516,7 @@ public function validateDigest($refNode, $data)
      * @return string
      * @throws Exception
      */
-    public function processTransforms($refNode, $objData, $includeCommentNodes = true)
+    public function processTransforms($refNode, $objData, $includeCommentNodes = true, $signing = false)
     {
         $data = $objData;
         $xpath = new DOMXPath($refNode->ownerDocument);
@@ -554,6 +576,17 @@ public function processTransforms($refNode, $objData, $includeCommentNodes = tru
 
                     break;
                 case 'http://www.w3.org/TR/1999/REC-xpath-19991116':
+                    /*
+                     * Reject attacker-controlled XPath transforms on the
+                     * verification path unless explicitly allowed. Signing uses
+                     * caller-supplied transforms and is always permitted.
+                     */
+                    if (! $signing && ! $this->allowXPathTransforms) {
+                        throw new Exception(
+                            'XPath Transforms are not allowed during verification; set '
+                            . 'XMLSecurityDSig::$allowXPathTransforms = true to enable them'
+                        );
+                    }
                     $xpathTransformCount++;
                     if ($xpathTransformCount > $this->maxXPathTransforms) {
                         throw new Exception(
@@ -817,7 +850,7 @@ private function addRefInternal($sinfoNode, $node, $algorithm, $arTransforms=nul
             $transNode->setAttribute('Algorithm', $this->canonicalMethod);
         }
 
-        $canonicalData = $this->processTransforms($refNode, $node);
+        $canonicalData = $this->processTransforms($refNode, $node, true, true);
         $digValue = $this->calculateDigest($algorithm, $canonicalData);
 
         $digestMethod = $this->createNewSignNode('DigestMethod');

tests/verify-xpath-transform-deny.phpt

@@ -0,0 +1,71 @@
+--TEST--
+XPath Transforms are rejected on the verify path by default (GHSA-7mf5-fjj8-mvjc)
+--FILE--
+<?php
+require(dirname(__FILE__) . '/../xmlseclibs.php');
+use RobRichards\XMLSecLibs\XMLSecurityDSig;
+use RobRichards\XMLSecLibs\XMLSecurityKey;
+
+/* Build a document that is legitimately signed with an XPath Transform. */
+function signWithXPathTransform() {
+    $doc = new DOMDocument();
+    $doc->load(dirname(__FILE__) . '/basic-doc.xml');
+    $objDSig = new XMLSecurityDSig();
+    $objDSig->setCanonicalMethod(XMLSecurityDSig::EXC_C14N);
+    $objDSig->addReference(
+        $doc,
+        XMLSecurityDSig::SHA256,
+        array(
+            'http://www.w3.org/2000/09/xmldsig#enveloped-signature',
+            array('http://www.w3.org/TR/1999/REC-xpath-19991116' => array('query' => 'true()')),
+        )
+    );
+    $objKey = new XMLSecurityKey(XMLSecurityKey::RSA_SHA256, array('type' => 'private'));
+    $objKey->loadKey(dirname(__FILE__) . '/privkey.pem', true);
+    $objDSig->sign($objKey);
+    $objDSig->appendSignature($doc->documentElement);
+    return $doc->saveXML();
+}
+
+function pubKey() {
+    $objKey = new XMLSecurityKey(XMLSecurityKey::RSA_SHA256, array('type' => 'public'));
+    $objKey->loadKey(dirname(__FILE__) . '/mycert.pem', true, true);
+    return $objKey;
+}
+
+$signedXml = signWithXPathTransform();
+
+/* 1. Signing with an XPath transform is unaffected. */
+print "SIGN: ".(strpos($signedXml, 'REC-xpath-19991116') !== false ? "ok" : "missing transform")."\n";
+
+/* 2. Default verification refuses the XPath transform (pre-auth DoS surface). */
+$doc = new DOMDocument();
+$doc->loadXML($signedXml);
+$objDSig = new XMLSecurityDSig();
+$objDSig->locateSignature($doc);
+$objDSig->canonicalizeSignedInfo();
+try {
+    $objDSig->validateReference();
+    print "DENY: not rejected\n";
+} catch (Exception $e) {
+    print "DENY: ".$e->getMessage()."\n";
+}
+
+/* 3. Opt-in allows it and the signature still validates. */
+$doc = new DOMDocument();
+$doc->loadXML($signedXml);
+$objDSig = new XMLSecurityDSig();
+$objDSig->allowXPathTransforms = true;
+$objDSig->locateSignature($doc);
+$objDSig->canonicalizeSignedInfo();
+try {
+    $objDSig->validateReference();
+    print "ALLOW: ".($objDSig->verify(pubKey()) === 1 ? "valid" : "invalid")."\n";
+} catch (Exception $e) {
+    print "ALLOW: ".$e->getMessage()."\n";
+}
+?>
+--EXPECTF--
+SIGN: ok
+DENY: XPath Transforms are not allowed during verification; set XMLSecurityDSig::$allowXPathTransforms = true to enable them
+ALLOW: valid

tests/xml-max-checks.phpt

@@ -14,6 +14,7 @@ foreach ($arTests AS $testName=>$testFile) {
 	try {
 		$doc->load(dirname(__FILE__) . "/$testFile");
 		$objXMLSecDSig = new XMLSecurityDSig();
+		$objXMLSecDSig->allowXPathTransforms = true;
 
 		$objDSig = $objXMLSecDSig->locateSignature($doc);
 		if (! $objDSig) {
@@ -57,6 +58,7 @@ foreach ($arTests AS $testName=>$testFile) {
 try {
 	$doc->load(dirname(__FILE__) . '/xml-max-transforms.xml');
 	$objXMLSecDSig = new XMLSecurityDSig();
+	$objXMLSecDSig->allowXPathTransforms = true;
 	$objXMLSecDSig->maxXPathTransforms = 2;
 	$objDSig = $objXMLSecDSig->locateSignature($doc);
 	$objXMLSecDSig->canonicalizeSignedInfo();
@@ -72,6 +74,7 @@ try {
 try {
 	$doc->load(dirname(__FILE__) . '/xml-max-transforms.xml');
 	$objXMLSecDSig = new XMLSecurityDSig();
+	$objXMLSecDSig->allowXPathTransforms = true;
 	$objXMLSecDSig->maxXPathTransforms = 100;
 	$objDSig = $objXMLSecDSig->locateSignature($doc);
 	$objXMLSecDSig->canonicalizeSignedInfo();
@@ -91,6 +94,7 @@ try {
 try {
 	$doc->load(dirname(__FILE__) . '/xml-max-namespaces.xml');
 	$objXMLSecDSig = new XMLSecurityDSig();
+	$objXMLSecDSig->allowXPathTransforms = true;
 	$objXMLSecDSig->maxXPathNamespaces = 100;
 	$objDSig = $objXMLSecDSig->locateSignature($doc);
 	$objXMLSecDSig->canonicalizeSignedInfo();