2026-09-10 · 8 min read
- xml
- signatures
- security
XML Digital Signature authenticates referenced data after transforms and canonicalization. It does not automatically assert that every element in the surrounding document is signed or that an application's later query selects the authenticated element.
Signature wrapping exploits that gap by relocating a legitimately signed element and inserting attacker-controlled content where business logic expects it. Broad XPath expressions, duplicate ID handling, namespace mistakes, and separate parse trees widen the gap.
Define a narrow accepted signature profile
Specify the expected root expanded name, schema, signature count and location, reference count, same-document targets, digest and signature algorithms, canonicalization method, transform set, and trusted key source. Reject extra or unsupported structure rather than ignoring it.
- Disable external entities and unneeded network resolution.
- Reject external Reference URIs unless the protocol requires and constrains them.
- Allow only reviewed transforms and algorithms.
- Establish certificate or key trust independently from signature math.
Make IDs and namespaces deterministic
Use schema-aware or library-configured ID attributes and require every referenced ID to be unique across the document. Attribute names that merely look like ID, Id, or id must not gain special meaning through an attacker's preferred parser behavior.
Validate expanded names as namespace URI plus local name. Prefix text is only an alias, and an attacker can rebind or shadow prefixes while preserving a familiar visual appearance.
Bind authorization to the verified node
After the maintained XMLDSig library verifies the constrained references, pass the returned verified element directly into schema validation and business extraction. Alternatively, preselect the one expected element by structural location and identity, then require the signature to reference exactly it.
- Do not perform a fresh descendant-wide search after verification.
- Do not copy values from an unsigned presentation wrapper.
- Avoid reparsing serialized fragments under different parser settings.
- Keep validation and use in one controlled processing pipeline.
Maintain adversarial structural fixtures
Use Flashman's XML formatter and diff only to inspect synthetic tree shapes, hash to label public fixtures, Base64 for disposable encoded signature fields, and PEM newline tool for public test-certificate formatting. These client-side tools do not verify signatures, certificate chains, or trust.
Run actual verification in trusted server-side tests with maintained libraries. Cover moved signed nodes, duplicate IDs, namespace rebinding, multiple signatures, empty and external references, unexpected transforms, schema-invalid placement, comments, canonicalization variants, parser differential behavior, and unsigned business fields. Never paste private keys or production assertions into browser tools.