[Mono-dev] Bug in SignedXml.GetIdElement

[Atsushi Eno]

Whenever SAML document instance refers to its schema or DTD that will 
validate "ID" attribute as expected, since SignedXml internally uses 
XmlDocument.GetElementById () which is expected to collect "IDs" where 
"IDs" means a validated ID by XmlValidatingReader or any XmlReader that 
has XmlReaderSettings to consider XmlSchema or DTD. Hence that does not 
cause any problem for SAML.

(Also note that SignedXml implementation could override 
SignedXml.GetIdElement(). Mono's WCF implementation makes use of it to 
support WS-Security ID attribute.)

Atsushi Eno

Jonathan Gagnon wrote:
> This is true for the signature, but not true for SAML assertions, 
> where ids are defined as "ID" :
>
> http://schemas.stylusstudio.com/saml/nea261b70/complexType_AssertionType.html
>
> I don't know in which case we would need "id" in lowercase, but since 
> .NET supports it, there is probably a valid reason for it too.
>
> *Jonathan Gagnon*
> Responsable des architectures systèmes
> 600, boulevard Armand-Frappier, bureau 200
> Laval (Québec) H7V 4B4
> Canada
> T : 450-662-6101 poste 234
> <http://www.croesus.com>
> <http://www.facebook.com/pages/Croesus-Finansoft/345020305606240><http://www.linkedin.com/company/croesus-finansoft?trk=hb_tab_compy_id_26141><https://twitter.com/CroesusFin>
>
>
>
> On Tue, Jul 16, 2013 at 2:30 AM, Atsushi Eno 
> <atsushieno at veritas-vos-liberabit.com 
> <mailto:atsushieno at veritas-vos-liberabit.com>> wrote:
>
>     W3C XML Signature specification explicitly "Id" as the valid
>     attribute name for referencing an element, by its XML Schema and DTD:
>     http://www.w3.org/TR/xmldsig-core/#sec-Signature
>     http://www.w3.org/TR/xmldsig-core/#sec-SignatureValue
>     http://www.w3.org/TR/xmldsig-core/#sec-SignedInfo
>     http://www.w3.org/TR/xmldsig-core/#sec-Reference
>     http://www.w3.org/TR/xmldsig-core/#sec-KeyInfo
>     http://www.w3.org/TR/xmldsig-core/#sec-Object
>     http://www.w3.org/TR/xmldsig-core/#sec-Manifest
>     http://www.w3.org/TR/xmldsig-core/#sec-SignatureProperties
>
>     If Microsoft treats "id" or "ID" attributes as if they were ID
>     (and not "iD" ?), they will have to fix their bug.
>
>     Atsushi Eno
>
>     (2013年07月12日 23:58), Jonathan Gagnon wrote:
>
>         I have encountered a bug similar to 4938
>         <https://bugzilla.xamarin.com/show_bug.cgi?id=4938>.
>
>
>         My problem is that mono does not find the reference id because
>         the id is in uppercase ('ID' instead of 'Id'). This works
>         correctly on .NET.
>
>         As stated in the bug description, the problem is in the
>         SignedXml class, GetIdElement method.
>
>         I wrote a very simple patch that fixes the problem by looking
>         for "id" and "ID". Should I do a pull request with that fix?
>
>         *Jonathan Gagnon*
>
>         Responsable des architectures systèmes
>         600, boulevard Armand-Frappier, bureau 200
>         Laval (Québec) H7V 4B4
>         Canada
>         T : 450-662-6101 <tel:450-662-6101> poste 234
>         <http://www.croesus.com>
>         <http://www.facebook.com/pages/Croesus-Finansoft/345020305606240><http://www.linkedin.com/company/croesus-finansoft?trk=hb_tab_compy_id_26141><https://twitter.com/CroesusFin>
>
>
>
>         _______________________________________________
>         Mono-devel-list mailing list
>         Mono-devel-list at lists.ximian.com
>         <mailto:Mono-devel-list at lists.ximian.com>
>         http://lists.ximian.com/mailman/listinfo/mono-devel-list
>
>
>