Repository navigation
Conversation
main.c calls xmlSecCryptoDLLoadLibrary() and xmlSecCryptoDLUnloadLibrary(), which are declared in <xmlsec/dl.h>, but never included that header directly. The declarations were only pulled in transitively via <xmlsec/crypto.h> -> <xmlsec/app.h> -> <xmlsec/dl.h> when XMLSEC_CRYPTO_DYNAMIC_LOADING is defined. xmlsec 1.3.13 dropped the #include <xmlsec/dl.h> from xmlsec/app.h, so builds with dynamic crypto loading enabled (e.g. MacPorts, Homebrew, distro packages) fail with "call to undeclared function" errors under -Werror=implicit-function-declaration. Static-crypto builds (XMLSEC_NO_CRYPTO_DYNAMIC_LOADING) are unaffected since those calls are compiled out. dl.h has existed since xmlsec 1.2.x and guards its declarations with XMLSEC_NO_CRYPTO_DYNAMIC_LOADING itself, so the include is safe for all supported versions and build modes. Fixes #434
xmlsec 1.3.13 changed three behaviors that broke the test suite: - xmlSecInit() can no longer be called twice without a shutdown: xmlSecTransformXsltInitialize() now returns an error instead of ignoring the failed assertion. Since the module initializes xmlsec on import, an explicit xmlsec.init() failed. Make init() a no-op when the library is already initialized. - xmlSecKeyDataEncryptedKeyXmlWrite() no longer copies the parent key info context preferences into the nested encryption context, so the lax key search enabled by EncryptionContext was lost when encrypting the session key into <enc:EncryptedKey/>, failing with "key is not found". Create the nested context upfront (xmlsec reuses it) and enable lax key search on its read context too. - The default allowed <dsig:Reference/> URI types changed from Any to Empty | SameDocument, so references to local/remote resources (e.g. cid: URIs served via register_callbacks) are rejected. Keep the secure upstream default and expose an opt-in: SignatureContext.enabled_reference_uris plus TransformUriType* constants. Refs #434
xmlsec 1.3.13 adds OSS-Fuzz harnesses under apps/ whose CFLAGS omit $(LIBXSLT_CFLAGS), while xmlsec/transforms.h includes <libxslt/security.h>. In static builds libxslt is installed into a private prefix, so building the fuzzers fails with "libxslt/security.h: No such file or directory". We only need the libraries, not the xmlsec1 CLI, unit tests or fuzzers, so configure with --disable-apps (also supported by older xmlsec1).
xmlsec 1.3.13 enables hardening flags by default and appends -fPIE
after the user-provided CFLAGS, overriding our -fPIC. The resulting
static libxmlsec1.a cannot be linked into the Python extension module
("relocation R_X86_64_PC32 against symbol ... can not be used when
making a shared object; recompile with -fPIC").
Pass --with-pic so libtool appends -fPIC last when compiling the
static objects, which keeps the other hardening flags intact.
xmlsec classifies only "file://" URIs as Local; every other non-empty, non-"#" URI (including relative paths such as "other.xml") is Remote. Release notes: Wheels now bundle xmlsec1 1.3.13, which by default only allows empty and same-document URIs (URI="", URI="#id") in <dsig:Reference>, <enc:CipherReference> and <dsig:RetrievalMethod>. To sign or verify references to external URIs (e.g. through xmlsec.register_callbacks), set SignatureContext.enabled_reference_uris using the new xmlsec.constants.TransformUriType* constants.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
main.c calls xmlSecCryptoDLLoadLibrary() and xmlSecCryptoDLUnloadLibrary(), which are declared in <xmlsec/dl.h>, but never included that header directly. The declarations were only pulled in transitively via <xmlsec/crypto.h> -> <xmlsec/app.h> -> <xmlsec/dl.h> when XMLSEC_CRYPTO_DYNAMIC_LOADING is defined.
xmlsec 1.3.13 dropped the #include <xmlsec/dl.h> from xmlsec/app.h, so builds with dynamic crypto loading enabled (e.g. MacPorts, Homebrew, distro packages) fail with "call to undeclared function" errors under -Werror=implicit-function-declaration. Static-crypto builds (XMLSEC_NO_CRYPTO_DYNAMIC_LOADING) are unaffected since those calls are compiled out.
dl.h has existed since xmlsec 1.2.x and guards its declarations with XMLSEC_NO_CRYPTO_DYNAMIC_LOADING itself, so the include is safe for all supported versions and build modes.
Fixes #434