From be80e81716302b1765419cb939e4c3c45cfaaad9 Mon Sep 17 00:00:00 2001 From: shunkica Date: Sun, 19 Oct 2025 11:17:59 +0200 Subject: [PATCH 1/2] deprecate: originalXmlWithIds and getOriginalXmlWithIds() as per issue #512 --- README.md | 2 +- src/signed-xml.ts | 7 +++--- test/signature-unit-tests.spec.ts | 37 ++++++++++++++++++++++--------- 3 files changed, 31 insertions(+), 15 deletions(-) diff --git a/README.md b/README.md index dfe164f2..f09c9b00 100644 --- a/README.md +++ b/README.md @@ -280,7 +280,7 @@ To sign xml documents: - `existingPrefixes` - A hash of prefixes and namespaces `prefix: namespace` that shouldn't be in the signature because they already exist in the xml - `getSignedXml()` - returns the original xml document with the signature in it, **must be called only after `computeSignature`** - `getSignatureXml()` - returns just the signature part, **must be called only after `computeSignature`** -- `getOriginalXmlWithIds()` - returns the original xml with Id attributes added on relevant elements (required for validation), **must be called only after `computeSignature`** +- `getOriginalXmlWithIds()` - **[deprecated]** returns the original xml with Id attributes added on relevant elements, **must be called only after `computeSignature`**. This method is deprecated and will be removed in a future version. Use `ComputeSignatureOptionsLocation` to control where the signature will be placed in the original XML. To verify xml documents: diff --git a/src/signed-xml.ts b/src/signed-xml.ts index 663d3d0e..5d3f285a 100644 --- a/src/signed-xml.ts +++ b/src/signed-xml.ts @@ -1403,13 +1403,14 @@ export class SignedXml { } /** - * Returns the original xml with Id attributes added on relevant elements (required for validation), must be called only after {@link computeSignature} + * Returns the original xml with Id attributes added on relevant elements, must be called only after {@link computeSignature} * * @returns The original XML with IDs. + * @deprecated This function is deprecated and will be removed in a future version. Use ComputeSignatureOptionsLocation to control where the signature will be placed in the original XML. */ - getOriginalXmlWithIds(): string { + getOriginalXmlWithIds = deprecate((): string => { return this.originalXmlWithIds; - } + }, "`getOriginalXmlWithIds()` is deprecated and will be removed in a future version. Use ComputeSignatureOptionsLocation to control where the signature will be placed in the original XML."); /** * Returns the original xml document with the signature in it, must be called only after {@link computeSignature} diff --git a/test/signature-unit-tests.spec.ts b/test/signature-unit-tests.spec.ts index c0dcf136..2ce3cedd 100644 --- a/test/signature-unit-tests.spec.ts +++ b/test/signature-unit-tests.spec.ts @@ -109,7 +109,7 @@ describe("Signature unit tests", function () { sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#"; sig.signatureAlgorithm = "http://www.w3.org/2000/09/xmldsig#rsa-sha1"; sig.computeSignature(xml); - const signedXml = sig.getOriginalXmlWithIds(); + const signedXml = sig.getSignedXml(); const doc = new xmldom.DOMParser().parseFromString(signedXml); const op = nsMode === "equal" ? "=" : "!="; @@ -172,9 +172,10 @@ describe("Signature unit tests", function () { sig.canonicalizationAlgorithm = "http://www.w3.org/2001/10/xml-exc-c14n#"; sig.signatureAlgorithm = "http://www.w3.org/2000/09/xmldsig#rsa-sha1"; sig.computeSignature(xml); - const signedXml = sig.getOriginalXmlWithIds(); + const signedXml = sig.getSignedXml(); const doc = new xmldom.DOMParser().parseFromString(signedXml); - const attrs = xpath.select("//@*", doc); + // Only count attributes on the 'x' element, not the entire document (which includes signature attributes) + const attrs = xpath.select("//*[local-name(.)='x']/@*", doc); isDomNode.assertIsArrayOfNodes(attrs); expect(attrs.length, "wrong number of attributes").to.equal(2); } @@ -535,10 +536,17 @@ describe("Signature unit tests", function () { expect(expectedSignedXml, "wrong signedXml format").to.equal(signedXml); - const originalXmlWithIds = sig.getOriginalXmlWithIds(); - const expectedOriginalXmlWithIds = - ''; - expect(expectedOriginalXmlWithIds, "wrong OriginalXmlWithIds").to.equal(originalXmlWithIds); + // Verify IDs were added to the signed XML document + const signedDoc = new xmldom.DOMParser().parseFromString(signedXml); + const xId = xpath.select1("//*[local-name(.)='x']/@*[local-name(.)='Id']", signedDoc); + isDomNode.assertIsAttributeNode(xId); + expect(xId.value).to.equal("_0"); + const yId = xpath.select1("//*[local-name(.)='y']/@*[local-name(.)='Id']", signedDoc); + isDomNode.assertIsAttributeNode(yId); + expect(yId.value).to.equal("_1"); + const wId = xpath.select1("//*[local-name(.)='w']/@*[local-name(.)='Id']", signedDoc); + isDomNode.assertIsAttributeNode(wId); + expect(wId.value).to.equal("_2"); }); it("signer creates signature with correct structure (with prefix)", function () { @@ -699,10 +707,17 @@ describe("Signature unit tests", function () { expect(signedXml, "wrong signedXml format").to.equal(expectedSignedXml); - const originalXmlWithIds = sig.getOriginalXmlWithIds(); - const expectedOriginalXmlWithIds = - ''; - expect(originalXmlWithIds, "wrong OriginalXmlWithIds").to.equal(expectedOriginalXmlWithIds); + // Verify IDs were added to the signed XML document + const signedDoc = new xmldom.DOMParser().parseFromString(signedXml); + const xId = xpath.select1("//*[local-name(.)='x']/@*[local-name(.)='Id']", signedDoc); + isDomNode.assertIsAttributeNode(xId); + expect(xId.value).to.equal("_0"); + const yId = xpath.select1("//*[local-name(.)='y']/@*[local-name(.)='Id']", signedDoc); + isDomNode.assertIsAttributeNode(yId); + expect(yId.value).to.equal("_1"); + const wId = xpath.select1("//*[local-name(.)='w']/@*[local-name(.)='Id']", signedDoc); + isDomNode.assertIsAttributeNode(wId); + expect(wId.value).to.equal("_2"); }); it("signer creates correct signature values", function () { From 90b04f4af555578a4ece6f42d17a980a0be1eb8c Mon Sep 17 00:00:00 2001 From: Chris Barth Date: Tue, 8 Sep 2026 00:00:20 -0500 Subject: [PATCH 2/2] deprecate: Refine `getOriginalXmlWithIds()` warning and guidance Adjust the deprecation mechanism for `getOriginalXmlWithIds()` to use a dedicated warning function. This change also clarifies the recommended alternative usage in the JSDoc and README, guiding users to employ the `location` option with `computeSignature()` followed by `getSignedXml()`. --- README.md | 2 +- src/signed-xml.ts | 14 +++++++++++--- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index f09c9b00..891e91c5 100644 --- a/README.md +++ b/README.md @@ -280,7 +280,7 @@ To sign xml documents: - `existingPrefixes` - A hash of prefixes and namespaces `prefix: namespace` that shouldn't be in the signature because they already exist in the xml - `getSignedXml()` - returns the original xml document with the signature in it, **must be called only after `computeSignature`** - `getSignatureXml()` - returns just the signature part, **must be called only after `computeSignature`** -- `getOriginalXmlWithIds()` - **[deprecated]** returns the original xml with Id attributes added on relevant elements, **must be called only after `computeSignature`**. This method is deprecated and will be removed in a future version. Use `ComputeSignatureOptionsLocation` to control where the signature will be placed in the original XML. +- `getOriginalXmlWithIds()` - **[deprecated]** returns the original xml with Id attributes added on relevant elements, **must be called only after `computeSignature`**. Use the `location` option of `computeSignature()` to place the signature, then `getSignedXml()`. See [how to specify the location of the signature](#how-to-specify-the-location-of-the-signature). To verify xml documents: diff --git a/src/signed-xml.ts b/src/signed-xml.ts index 5d3f285a..6a3c2ae3 100644 --- a/src/signed-xml.ts +++ b/src/signed-xml.ts @@ -27,6 +27,12 @@ import * as hashAlgorithms from "./hash-algorithms"; import * as signatureAlgorithms from "./signature-algorithms"; import * as utils from "./utils"; +const warnOriginalXmlWithIds = deprecate( + () => {}, + "`getOriginalXmlWithIds()` is deprecated and will be removed in a future version. Use the `location` option of `computeSignature()` to place the signature, then `getSignedXml()`.", + "XML_CRYPTO_GET_ORIGINAL_XML_WITH_IDS", +); + export class SignedXml { idMode?: "wssecurity"; idAttributes: string[]; @@ -1406,11 +1412,13 @@ export class SignedXml { * Returns the original xml with Id attributes added on relevant elements, must be called only after {@link computeSignature} * * @returns The original XML with IDs. - * @deprecated This function is deprecated and will be removed in a future version. Use ComputeSignatureOptionsLocation to control where the signature will be placed in the original XML. + * @deprecated Will be removed in a future version. Use the `location` option of + * {@link computeSignature} to place the signature, then {@link getSignedXml}. */ - getOriginalXmlWithIds = deprecate((): string => { + getOriginalXmlWithIds(): string { + warnOriginalXmlWithIds(); return this.originalXmlWithIds; - }, "`getOriginalXmlWithIds()` is deprecated and will be removed in a future version. Use ComputeSignatureOptionsLocation to control where the signature will be placed in the original XML."); + } /** * Returns the original xml document with the signature in it, must be called only after {@link computeSignature}