From a91c74ecace64b031cc975a78078e7b604f7ec73 Mon Sep 17 00:00:00 2001 From: Aleksey Sanin Date: Wed, 30 Sep 2026 17:31:12 -0400 Subject: [PATCH] (xmlsec-core) Mark read/write of private keys to XML as proprietary and deprecated --- include/xmlsec/strings.h | 4 ++++ src/keysdata_helpers.c | 22 +++++++++++++++------- src/strings.c | 4 ++++ tests/keys/keys.xml | 2 +- 4 files changed, 24 insertions(+), 8 deletions(-) diff --git a/include/xmlsec/strings.h b/include/xmlsec/strings.h index a30ef210c..fa310649c 100644 --- a/include/xmlsec/strings.h +++ b/include/xmlsec/strings.h @@ -317,6 +317,8 @@ XMLSEC_EXPORT_VAR const xmlChar xmlSecNodeDSAP[]; XMLSEC_EXPORT_VAR const xmlChar xmlSecNodeDSAQ[]; XMLSEC_EXPORT_VAR const xmlChar xmlSecNodeDSAG[]; XMLSEC_EXPORT_VAR const xmlChar xmlSecNodeDSAJ[]; +/* DSA X node is proprietary extension by XMLSec library and uses xmlSecNs namespace. + * DEPRECATED and will be removed in the future. */ XMLSEC_EXPORT_VAR const xmlChar xmlSecNodeDSAX[]; XMLSEC_EXPORT_VAR const xmlChar xmlSecNodeDSAY[]; XMLSEC_EXPORT_VAR const xmlChar xmlSecNodeDSASeed[]; @@ -740,6 +742,8 @@ XMLSEC_EXPORT_VAR const xmlChar xmlSecHrefRSAKeyValue[]; XMLSEC_EXPORT_VAR const xmlChar xmlSecNodeRSAModulus[]; XMLSEC_EXPORT_VAR const xmlChar xmlSecNodeRSAExponent[]; +/* PrivateExponent node is proprietary extension by XMLSec library and uses xmlSecNs namespace. + * DEPRECATED and will be removed in the future. */ XMLSEC_EXPORT_VAR const xmlChar xmlSecNodeRSAPrivateExponent[]; XMLSEC_EXPORT_VAR const xmlChar xmlSecNameRsaMd5[]; diff --git a/src/keysdata_helpers.c b/src/keysdata_helpers.c index a7e851638..4c381398e 100644 --- a/src/keysdata_helpers.c +++ b/src/keysdata_helpers.c @@ -1924,7 +1924,9 @@ xmlSecKeyValueDsaXmlRead(xmlSecKeyValueDsaPtr data, xmlNodePtr node) { } cur = xmlSecGetNextElementNode(cur->next); - if((cur != NULL) && (xmlSecCheckNodeName(cur, xmlSecNodeDSAX, xmlSecDSigNs))) { + /* DSA X node is proprietary extension by XMLSec library and uses xmlSecNs namespace. + * DEPRECATED and will be removed in the future. */ + if((cur != NULL) && (xmlSecCheckNodeName(cur, xmlSecNodeDSAX, xmlSecNs))) { /* next is X node. It is REQUIRED for private key but * we are not sure exactly what we are reading */ ret = xmlSecBufferBase64NodeContentRead(&(data->x), cur); @@ -2120,9 +2122,11 @@ xmlSecKeyValueDsaXmlWrite(xmlSecKeyValueDsaPtr data, xmlNodePtr node, #endif /* LIBXML_VERSION >= 21300 */ } - /* next is X node: write it ONLY for private keys and ONLY if it is requested */ + /* next is X node: write it ONLY for private keys and ONLY if it is requested. + * DSA X node is proprietary extension by XMLSec library and uses xmlSecNs namespace. + * DEPRECATED and will be removed in the future. */ if((writePrivateKey != 0) && (xmlSecBufferGetSize(&(data->x)) > 0)) { - cur = xmlSecAddChild(node, xmlSecNodeDSAX, xmlSecDSigNs); + cur = xmlSecAddChild(node, xmlSecNodeDSAX, xmlSecNs); if(cur == NULL) { xmlSecInternalError("xmlSecAddChild(NodeDSAX)", NULL); return(-1); @@ -2466,8 +2470,10 @@ xmlSecKeyValueRsaXmlRead(xmlSecKeyValueRsaPtr data, xmlNodePtr node) { cur = xmlSecGetNextElementNode(cur->next); /* next is PrivateExponent node. It is REQUIRED for private key but - * we are not sure exactly what we are reading */ - if((cur != NULL) && (xmlSecCheckNodeName(cur, xmlSecNodeRSAPrivateExponent, xmlSecDSigNs))) { + * we are not sure exactly what we are reading. + * PrivateExponent node is proprietary extension by XMLSec library and uses xmlSecNs namespace. + * DEPRECATED and will be removed in the future. */ + if((cur != NULL) && (xmlSecCheckNodeName(cur, xmlSecNodeRSAPrivateExponent, xmlSecNs))) { ret = xmlSecBufferBase64NodeContentRead(&(data->privateExponent), cur); if(ret < 0) { xmlSecInternalError("xmlSecBufferBase64NodeContentRead(privateExponent)", NULL); @@ -2589,9 +2595,11 @@ xmlSecKeyValueRsaXmlWrite(xmlSecKeyValueRsaPtr data, xmlNodePtr node, #endif /* LIBXML_VERSION >= 21300 */ } - /* next is PrivateExponent node: write it ONLY for private keys and ONLY if it is requested */ + /* next is PrivateExponent node: write it ONLY for private keys and ONLY if it is requested + * PrivateExponent node is proprietary extension by XMLSec library and uses xmlSecNs namespace. + * DEPRECATED and will be removed in the future. */ if((writePrivateKey != 0) && (xmlSecBufferGetSize(&(data->privateExponent)) > 0)) { - cur = xmlSecAddChild(node, xmlSecNodeRSAPrivateExponent, xmlSecDSigNs); + cur = xmlSecAddChild(node, xmlSecNodeRSAPrivateExponent, xmlSecNs); if(cur == NULL) { xmlSecInternalError("xmlSecAddChild(PrivateExponent)", NULL); return(-1); diff --git a/src/strings.c b/src/strings.c index 7cabf70dc..c8ab4802b 100644 --- a/src/strings.c +++ b/src/strings.c @@ -323,6 +323,8 @@ const xmlChar xmlSecNodeDSAP[] = "P"; const xmlChar xmlSecNodeDSAQ[] = "Q"; const xmlChar xmlSecNodeDSAG[] = "G"; const xmlChar xmlSecNodeDSAJ[] = "J"; +/* DSA X node is proprietary extension by XMLSec library and uses xmlSecNs namespace. + * DEPRECATED and will be removed in the future. */ const xmlChar xmlSecNodeDSAX[] = "X"; const xmlChar xmlSecNodeDSAY[] = "Y"; const xmlChar xmlSecNodeDSASeed[] = "Seed"; @@ -707,6 +709,8 @@ const xmlChar xmlSecNodeRSAKeyValue[] = "RSAKeyValue"; const xmlChar xmlSecHrefRSAKeyValue[] = "http://www.w3.org/2000/09/xmldsig#RSAKeyValue"; const xmlChar xmlSecNodeRSAModulus[] = "Modulus"; const xmlChar xmlSecNodeRSAExponent[] = "Exponent"; +/* PrivateExponent node is proprietary extension by XMLSec library and uses xmlSecNs namespace. + * DEPRECATED and will be removed in the future. */ const xmlChar xmlSecNodeRSAPrivateExponent[] = "PrivateExponent"; const xmlChar xmlSecNameRsaMd5[] = "rsa-md5"; diff --git a/tests/keys/keys.xml b/tests/keys/keys.xml index 897737115..7ad6f65be 100644 --- a/tests/keys/keys.xml +++ b/tests/keys/keys.xml @@ -23,7 +23,7 @@ Rrg7e8pNLHMFK0pGW7xvzb7Kh6icJSsiBaX6aHqaQc9rSzzMJG3snBuQricNaUH5 8ipucT+hdPRTo6g0ty5noyyBmqUvYHf9NuskQhPDmC3uTtqQTHeCEuX8XoH3YYlB uE4nXvQRGZoyy+43ISe9aDnEAgIUVQXEayTVppRF24I= - + S3Gt9BE+wZb996U6h4nSNtYxEmE=