Add traversal limit to TransformExcC14n to prevent pathological XML inputs

transformExcC14n recursed through child elements without checking
the NSContext traversal limit, unlike other recursive functions
(NSTraverse, etc.). Deeply nested XML documents could cause unbounded
recursion. Add CheckLimit() call at the top of the recursive function.

Author: russellhaering

internal/xmldsig/etree_canonicalize.go

@@ -26,6 +26,10 @@ func TransformExcC14n(el *etree.Element, inclusiveNamespacesPrefixList string, c
 }
 
 func transformExcC14n(ctx, declared NSContext, el *etree.Element, inclusiveNamespaces map[string]struct{}, comments bool) error {
+	if err := ctx.CheckLimit(); err != nil {
+		return err
+	}
+
 	scope, err := ctx.SubContext(el)
 	if err != nil {
 		return err