Bug #81188 [Opn]: C14N wrong namespace order

Edit report at https://bugs.php.net/bug.php?id=81188&edit=1 ID: 81188 User updated by: bill dot seddon at lyquidity dot com Reported by: bill dot seddon at lyquidity dot com Summary: C14N wrong namespace order Status: Open Type: Bug Package: *XML functions Operating System: Windows 10 PHP Version: 8.0.7 Block user comment: N Private report: N New Comment: It may be this issue is that the C14N function of libxml exposed by the php_libxml extension only follows the canonical XML specification 1.0 from 2000 (https://www.w3.org/TR/2000/WD-xml-c14n-20000119.html) which explicitly avoids namespaces (see section 2.5). In the meantime there is the more 'recent' (2008!) 1.1 specification which does cover namespaces in section 4.8. Libxml does support C14N 1.1. For example, xmllint includes the switch -c14n11 so this revision of the specification can be used. Previous Comments: ------------------------------------------------------------------------ [2021-06-21 23:36:22] bill dot seddon at lyquidity dot com Description: ------------ My use case is checking XmlDSig signatures. The Xml in the test script is asnippet of the type found within a <transform> element of a signature. The order of the canonicalized attributes and element nodes is important because the resulting Xml is hashed. Unless the canonicalized Xml is generated correctly the hash will be different to a hash computed by other software. Bear in mind that this existing Xml generated by other other application so the option to modify the input Xml does not exist. Note the order of the attributes in the <XPath> element: xmlns:dsig-xpath, filter, xmlns. When this is canonicalized using PHP 5.3 through to 8.0 using the test script provided the result is the Xml shown in the 'actual result'. Here the order of the attributes is: xmlns:dsig-xpath, xmlns, filter Correctly, the namespace attributes appear before value attributes. However namespaces are being returned in their document order. When using any other tool to canonicalize this fragment such as xmllint, MS Cryptography, Python lxml the namespace attributes are sorted by the attribute node name to give the result shown in the 'expected result'. All other canonicalization implementations I can find order the attributes this way: xmlns, xmlns:dsig-xpath, filter. I believe this is consistent with section 4.8 of the canonicalization specification: https://www.w3.org/TR/2001/REC-xml-c14n-20010315#SortByNSURI Oddly, PHP, xmllint and Python's lxml are all based on libxml. However it's the PHP implementation that yields a different result. Test script: --------------- $xml = "<XPath xmlns:dsig-xpath=\"http://www.w3.org/2002/06/xmldsig-filter2\" Filter=\"subtract\" xmlns=\"http://www.w3.org/2002/06/xmldsig-filter2\">some xpath</XPath>"; $doc = new \DOMDocument(); $doc->loadXML( $xml ); $doc->C14N( false, true ); $xml = $doc->saveXML( $doc->documentElement, LIBXML_NOEMPTYTAG ); Expected result: ---------------- <XPath xmlns="http://www.w3.org/2002/06/xmldsig-filter2" xmlns:dsig-xpath="http://www.w3.org/2002/06/xmldsig-filter2" Filter="subtract">some xpath</XPath> Actual result: -------------- <XPath xmlns:dsig-xpath="http://www.w3.org/2002/06/xmldsig-filter2" xmlns="http://www.w3.org/2002/06/xmldsig-filter2" Filter="subtract">some xpath</XPath> ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=81188&edit=1