diff --git a/README.md b/README.md
index dfe164f2..891e91c5 100644
--- a/README.md
+++ b/README.md
@@ -280,7 +280,7 @@ To sign xml documents:
- `existingPrefixes` - A hash of prefixes and namespaces `prefix: namespace` that shouldn't be in the signature because they already exist in the xml
- `getSignedXml()` - returns the original xml document with the signature in it, **must be called only after `computeSignature`**
- `getSignatureXml()` - returns just the signature part, **must be called only after `computeSignature`**
-- `getOriginalXmlWithIds()` - returns the original xml with Id attributes added on relevant elements (required for validation), **must be called only after `computeSignature`**
+- `getOriginalXmlWithIds()` - **[deprecated]** returns the original xml with Id attributes added on relevant elements, **must be called only after `computeSignature`**. Use the `location` option of `computeSignature()` to place the signature, then `getSignedXml()`. See [how to specify the location of the signature](#how-to-specify-the-location-of-the-signature).
To verify xml documents:
diff --git a/src/signed-xml.ts b/src/signed-xml.ts
index 5ba0a912..843a53bf 100644
--- a/src/signed-xml.ts
+++ b/src/signed-xml.ts
@@ -27,6 +27,12 @@ import * as hashAlgorithms from "./hash-algorithms";
import * as signatureAlgorithms from "./signature-algorithms";
import * as utils from "./utils";
+const warnOriginalXmlWithIds = deprecate(
+ () => {},
+ "`getOriginalXmlWithIds()` is deprecated and will be removed in a future version. Use the `location` option of `computeSignature()` to place the signature, then `getSignedXml()`.",
+ "XML_CRYPTO_GET_ORIGINAL_XML_WITH_IDS",
+);
+
export class SignedXml {
idMode?: "wssecurity";
idAttributes: string[];
@@ -1423,11 +1429,14 @@ export class SignedXml {
}
/**
- * Returns the original xml with Id attributes added on relevant elements (required for validation), must be called only after {@link computeSignature}
+ * Returns the original xml with Id attributes added on relevant elements, must be called only after {@link computeSignature}
*
* @returns The original XML with IDs.
+ * @deprecated Will be removed in a future version. Use the `location` option of
+ * {@link computeSignature} to place the signature, then {@link getSignedXml}.
*/
getOriginalXmlWithIds(): string {
+ warnOriginalXmlWithIds();
return this.originalXmlWithIds;
}
diff --git a/test/signature-unit-tests.spec.ts b/test/signature-unit-tests.spec.ts
index c0dcf136..2ce3cedd 100644
--- a/test/signature-unit-tests.spec.ts
+++ b/test/signature-unit-tests.spec.ts
@@ -109,7 +109,7 @@ describe("Signature unit tests", function () {
sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
sig.signatureAlgorithm = "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
sig.computeSignature(xml);
- const signedXml = sig.getOriginalXmlWithIds();
+ const signedXml = sig.getSignedXml();
const doc = new xmldom.DOMParser().parseFromString(signedXml);
const op = nsMode === "equal" ? "=" : "!=";
@@ -172,9 +172,10 @@ describe("Signature unit tests", function () {
sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#";
sig.signatureAlgorithm = "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
sig.computeSignature(xml);
- const signedXml = sig.getOriginalXmlWithIds();
+ const signedXml = sig.getSignedXml();
const doc = new xmldom.DOMParser().parseFromString(signedXml);
- const attrs = xpath.select("//@*", doc);
+ // Only count attributes on the 'x' element, not the entire document (which includes signature attributes)
+ const attrs = xpath.select("//*[local-name(.)='x']/@*", doc);
isDomNode.assertIsArrayOfNodes(attrs);
expect(attrs.length, "wrong number of attributes").to.equal(2);
}
@@ -535,10 +536,17 @@ describe("Signature unit tests", function () {
expect(expectedSignedXml, "wrong signedXml format").to.equal(signedXml);
- const originalXmlWithIds = sig.getOriginalXmlWithIds();
- const expectedOriginalXmlWithIds =
- '';
- expect(expectedOriginalXmlWithIds, "wrong OriginalXmlWithIds").to.equal(originalXmlWithIds);
+ // Verify IDs were added to the signed XML document
+ const signedDoc = new xmldom.DOMParser().parseFromString(signedXml);
+ const xId = xpath.select1("//*[local-name(.)='x']/@*[local-name(.)='Id']", signedDoc);
+ isDomNode.assertIsAttributeNode(xId);
+ expect(xId.value).to.equal("_0");
+ const yId = xpath.select1("//*[local-name(.)='y']/@*[local-name(.)='Id']", signedDoc);
+ isDomNode.assertIsAttributeNode(yId);
+ expect(yId.value).to.equal("_1");
+ const wId = xpath.select1("//*[local-name(.)='w']/@*[local-name(.)='Id']", signedDoc);
+ isDomNode.assertIsAttributeNode(wId);
+ expect(wId.value).to.equal("_2");
});
it("signer creates signature with correct structure (with prefix)", function () {
@@ -699,10 +707,17 @@ describe("Signature unit tests", function () {
expect(signedXml, "wrong signedXml format").to.equal(expectedSignedXml);
- const originalXmlWithIds = sig.getOriginalXmlWithIds();
- const expectedOriginalXmlWithIds =
- '';
- expect(originalXmlWithIds, "wrong OriginalXmlWithIds").to.equal(expectedOriginalXmlWithIds);
+ // Verify IDs were added to the signed XML document
+ const signedDoc = new xmldom.DOMParser().parseFromString(signedXml);
+ const xId = xpath.select1("//*[local-name(.)='x']/@*[local-name(.)='Id']", signedDoc);
+ isDomNode.assertIsAttributeNode(xId);
+ expect(xId.value).to.equal("_0");
+ const yId = xpath.select1("//*[local-name(.)='y']/@*[local-name(.)='Id']", signedDoc);
+ isDomNode.assertIsAttributeNode(yId);
+ expect(yId.value).to.equal("_1");
+ const wId = xpath.select1("//*[local-name(.)='w']/@*[local-name(.)='Id']", signedDoc);
+ isDomNode.assertIsAttributeNode(wId);
+ expect(wId.value).to.equal("_2");
});
it("signer creates correct signature values", function () {