Mailing-List: contact security-dev-help@xml.apache.org; run by ezmlm
Precedence: bulk
Reply-To: security-dev@xml.apache.org
Received-SPF: pass (herse.apache.org: local policy)
Date: Wed, 30 May 2007 12:17:42 -0400
From: Sean Mullan <Sean.Mullan@Sun.COM>
Subject: Re: Signature and children - redundant namespace declarations
In-reply-to: <465C7438.5060504@georgetown.edu>
Sender: Sean.Mullan@Sun.COM
To: security-dev@xml.apache.org
Message-id: <465DA3A6.6040204@sun.com>
MIME-version: 1.0
Content-type: text/plain; format=flowed; charset=ISO-8859-1
Content-transfer-encoding: 7BIT
References: <465C7438.5060504@georgetown.edu>
User-Agent: Thunderbird 1.5.0.10 (X11/20070303)

Brent Putman wrote:
> When I generate a signature using XMLSignature, the library is
> redundantly adding the signature namespace declaration on every child
> element of the ds:Signature element.  Is there any way that this
> behavior can be avoided or turned off?  Am I doing something wrong?  I
> looked in the docs, I couldn't find any relevant settings, but maybe I
> missed something.

This should only happen if you have a dependency on XPath, for example 
you are using an XPath Transform. This is to workaround a problem in 
Xalan, in which the parent namespace nodes are not visible in the 
children. See http://nagoya.apache.org/bugzilla/show_bug.cgi?id=2650

--Sean

> 
> It would be ideal if it could be declared only once, on the ds:Signature
> object itself.  I know it's mostly a cosmetic thing, but one of our
> OpenSAML users noticed and inquired about it, so I wanted to see if
> there is an easy solution.  If not, the only alternative I could think
> of was to post-process the DOM and remove the redundant declarations
> (before signing, of course).
> 
> Thanks,
> Brent