Skip to content

Commit 5229bf2

Browse files
svillegas-cddsvillegas-cdd
committed
chore: Update to SignXML 4.0.0 version
- Updated error messages and expected exception in tests. - Updated `add_pem_cert_header_footer` and now `signxml.util.add_pem_header` returns a byte object. - Removed use of `crypto_utils._X509CertOpenSsl` in `verify_xml_signature` as SignXML has deprecated PyOpenSSL. Ref: https://app.shortcut.com/cordada/story/11838/ [sc-11838]
1 parent a694db1 commit 5229bf2

5 files changed

+213
-66
lines changed

‎src/cl_sii/libs/crypto_utils.py

+1-2
Original file line numberDiff line numberDiff line change
@@ -157,8 +157,7 @@ def add_pem_cert_header_footer(pem_cert: bytes) -> bytes:
157157
"""
158158
pem_value_str = pem_cert.decode('ascii')
159159
# note: it would be great if 'add_pem_header' did not forcefully convert bytes to str.
160-
mod_pem_value_str = signxml.util.add_pem_header(pem_value_str)
161-
mod_pem_value: bytes = mod_pem_value_str.encode('ascii')
160+
mod_pem_value: bytes = signxml.util.add_pem_header(pem_value_str)
162161
return mod_pem_value
163162

164163

‎src/cl_sii/libs/xml_utils.py

+5-11
Original file line numberDiff line numberDiff line change
@@ -440,14 +440,8 @@ def verify_xml_signature(
440440
)
441441

442442
if isinstance(trusted_x509_cert, crypto_utils._X509CertOpenSsl):
443-
trusted_x509_cert_open_ssl = trusted_x509_cert
444-
elif isinstance(trusted_x509_cert, crypto_utils.X509Cert):
445-
trusted_x509_cert_open_ssl = crypto_utils._X509CertOpenSsl.from_cryptography(
446-
trusted_x509_cert
447-
)
448-
elif trusted_x509_cert is None:
449-
trusted_x509_cert_open_ssl = None
450-
else:
443+
trusted_x509_cert = trusted_x509_cert.to_cryptography()
444+
elif not (isinstance(trusted_x509_cert, crypto_utils.X509Cert) or trusted_x509_cert is None):
451445
# A 'crypto_utils._X509CertOpenSsl' is ok but we prefer 'crypto_utils.X509Cert'.
452446
raise TypeError("'trusted_x509_cert' must be a 'crypto_utils.X509Cert' instance, or None.")
453447

@@ -481,10 +475,10 @@ def verify_xml_signature(
481475
# https://github.com/XML-Security/signxml/commit/ef15da8dbb904f1dedfdd210ae3e0df5da535612
482476
result = xml_verifier.verify(
483477
data=tmp_bytes,
484-
require_x509=True,
485-
x509_cert=trusted_x509_cert_open_ssl,
486-
ignore_ambiguous_key_info=True,
478+
x509_cert=trusted_x509_cert,
487479
expect_config=signxml.verifier.SignatureConfiguration(
480+
require_x509=True,
481+
ignore_ambiguous_key_info=True,
488482
signature_methods=frozenset([signxml.algorithms.SignatureMethod.RSA_SHA1]),
489483
digest_algorithms=frozenset([signxml.algorithms.DigestAlgorithm.SHA1]),
490484
),

‎src/tests/test_data/sii-dte/DTE--60910000-1--33--no-expired-sign.xml

+138
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
<?xml version="1.0" encoding="windows-1252"?>
2+
<DTE version="1.0">
3+
<Documento ID="DTE-33-2336600">
4+
<Encabezado>
5+
<IdDoc>
6+
<TipoDTE>33</TipoDTE>
7+
<Folio>2336600</Folio>
8+
<FchEmis>2019-08-08</FchEmis>
9+
<IndServicio>2</IndServicio>
10+
<FmaPago>1</FmaPago>
11+
<FchCancel>2019-08-08</FchCancel>
12+
<MedioPago>OT</MedioPago>
13+
<FchVenc>2019-08-08</FchVenc>
14+
</IdDoc>
15+
<Emisor>
16+
<RUTEmisor>60910000-1</RUTEmisor>
17+
<RznSoc>Universidad de Chile</RznSoc>
18+
<GiroEmis>Corporación Educacional y Servicios Profesionales</GiroEmis>
19+
<Acteco>803010</Acteco>
20+
<Sucursal>NIC Chile</Sucursal>
21+
<CdgSIISucur>67051191</CdgSIISucur>
22+
<DirOrigen>Miraflores 222, Piso 14</DirOrigen>
23+
<CmnaOrigen>Santiago</CmnaOrigen>
24+
<CiudadOrigen>Santiago</CiudadOrigen>
25+
</Emisor>
26+
<Receptor>
27+
<RUTRecep>76555835-2</RUTRecep>
28+
<RznSocRecep>FYNPAL SPA</RznSocRecep>
29+
<GiroRecep>PROCESAMIENTO DE DATOS Y ACTIVIDADES REL</GiroRecep>
30+
<Contacto>Germán Enrique Larraín Muñoz</Contacto>
31+
<DirRecep>El Bosque Norte 0177 Tel:+56.226051886</DirRecep>
32+
<CmnaRecep>Las Condes</CmnaRecep>
33+
<CiudadRecep>Santiago</CiudadRecep>
34+
</Receptor>
35+
<Totales>
36+
<MntNeto>8943</MntNeto>
37+
<TasaIVA>19</TasaIVA>
38+
<IVA>1699</IVA>
39+
<MntTotal>10642</MntTotal>
40+
</Totales>
41+
</Encabezado>
42+
<Detalle>
43+
<NroLinDet>1</NroLinDet>
44+
<NmbItem>dominio fyndata/6895189/1</NmbItem>
45+
<QtyItem>1.0</QtyItem>
46+
<PrcItem>8942.86</PrcItem>
47+
<MontoItem>8943</MontoItem>
48+
</Detalle>
49+
<TED version="1.0">
50+
<DD>
51+
<RE>60910000-1</RE>
52+
<TD>33</TD>
53+
<F>2336600</F>
54+
<FE>2019-08-08</FE>
55+
<RR>76555835-2</RR>
56+
<RSR>FYNPAL SPA</RSR>
57+
<MNT>10642</MNT>
58+
<IT1>dominio fyndata/6895189/1</IT1>
59+
<CAF version="1.0">
60+
<DA>
61+
<RE>60910000-1</RE>
62+
<RS>UNIVERSIDAD DE CHILE</RS>
63+
<TD>33</TD>
64+
<RNG>
65+
<D>2332141</D>
66+
<H>2342140</H>
67+
</RNG>
68+
<FA>2019-07-26</FA>
69+
<RSAPK>
70+
<M>x72ZshWkkg+YP+uhApMtGPaFPr7DKS3aK7LXTKvVBpCwWJmuvaQvTBnvxnBJVSnU0IVZUYPayO3NTLrLOFwxWw==</M>
71+
<E>Aw==</E>
72+
</RSAPK>
73+
<IDK>300</IDK>
74+
</DA>
75+
<FRMA algoritmo="SHA1withRSA">RJh0IgoGPl5SJrrRz/pZPt4i/3EweSAsnUFKo56OP0vwplcqNaaHmUT4IA21kJ7UJkt1KYKiDXco6P61sjLmFg==</FRMA>
76+
</CAF>
77+
<TSTED>2019-08-09T09:41:09</TSTED>
78+
</DD>
79+
<FRMT algoritmo="SHA1withRSA">NQe6wuZp1zwAjliDNobKgn7Pid6HlhTlEuP2n3xYDBgUZYe8NbJsOP337C3cptUPHylCBO7/8SmaBjJnPYgyyA==</FRMT>
80+
</TED>
81+
<TmstFirma>2019-08-09T09:41:09</TmstFirma>
82+
</Documento>
83+
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
84+
<SignedInfo>
85+
<CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
86+
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
87+
<Reference URI="#DTE-33-2336600">
88+
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
89+
<DigestValue>FYAfBvdM9IXwWnv9VIG/rVEBSGQ=</DigestValue>
90+
</Reference>
91+
</SignedInfo>
92+
<SignatureValue>
93+
oPypEHHhjUD62obkzgftzQZHvsEhb319UFVwf8DtRW2esiq0RrT5Iu0jXSNpA0fWan0XoRYaWfKX
94+
1MbCAMxhdPsmxjUxFqA5npPA3z/h/8IMR7amaC3lJtgi07P5U8aZ+2VZm0rOaZPGo5tqFo60E7nL
95+
f4dQg+CB68hDZcfCwZM9OZz+mJ5o9qjXyIqKLYTljvfHD13n9UiBHoOoootyjLI//2ytemiwtq0V
96+
fMjW6aOl9MSr79huvu9p4AIwrbNR2kmfjCVJCRPKMzpsLH+ED4Y0X4PxVNmUKDGoVg4m7/FhXSSz
97+
DqvLBVSJp4xyNEik7BlSoCNTMu1ytXPVqMSvQw==
98+
</SignatureValue>
99+
<KeyInfo>
100+
<KeyValue>
101+
<RSAKeyValue>
102+
<Modulus>
103+
qZxedJpwh9O3/fzz+PK8jN1BdoLMecLxFmD+WUIEs88gkJ8xfAPihzTR0lBqxa9BTfqH0ClNLg3Y
104+
yfuP88Eaet7HRW/KNOWo98Dpzgu4uWgK4RTI2uZjusc7KHATTphczryUVSkP/jag12GW4uzfR0cs
105+
D+PXyUZphhdrks+U3ycAxWRCpeCddxybNvfHQOykHnG5eW6bDVwCeEI/m/S6I9b8Z2ziJFrFhbqH
106+
S5IBSwQKmXbv/t9gMYQ3y8z5mPsN2KzdmVGvfxIDTcmNqx25X5wcdIoI4v01/mk9LTmmPKwtipz9
107+
1ocYoFSR0c/jMUJApEe26GxKqhXxx/AqSBlwmw==
108+
</Modulus>
109+
<Exponent>AQAB</Exponent>
110+
</RSAKeyValue>
111+
</KeyValue>
112+
<X509Data>
113+
<X509Certificate>
114+
MIIDqjCCApKgAwIBAgIUbi8ZEk0yHygPpMFA9X5U8ePe/4IwDQYJKoZIhvcNAQEL
115+
BQAweDELMAkGA1UEBhMCQ0wxCzAJBgNVBAgMAlJNMREwDwYDVQQHDAhTYW50aWFn
116+
bzENMAsGA1UECgwEQWNtZTENMAsGA1UECwwEQWNtZTENMAsGA1UEAwwEQWNtZTEc
117+
MBoGCSqGSIb3DQEJARYNQWNtZUBBY21lLmNvbTAeFw0yNDEyMTExODAyMDZaFw0y
118+
NTAxMTAxODAyMDZaMHgxCzAJBgNVBAYTAkNMMQswCQYDVQQIDAJSTTERMA8GA1UE
119+
BwwIU2FudGlhZ28xDTALBgNVBAoMBEFjbWUxDTALBgNVBAsMBEFjbWUxDTALBgNV
120+
BAMMBEFjbWUxHDAaBgkqhkiG9w0BCQEWDUFjbWVAQWNtZS5jb20wggEiMA0GCSqG
121+
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCueUjJeFhrl/MwNzTx0KN3RXhPtXYURWTK
122+
Eg7NWrw4+Ho7UNg5f9EnVJQ8yPvEkD2aNmOL6kH/waabB5hjhWD2xE0JbPd/3rNr
123+
ttGAMYwVPyWOcB7Btho3B88D8ek4Abg1jvjTiuHy/hg2PINnpz7Nh85kPtf2p4vq
124+
vqMG9kkuAoyNKDkU36UE6lLBsvtChFJq1ReMyS4+jGD0ubeqm/ZO5rKHnK6vKt34
125+
gTqVsBl9QyhFM3y2eO7jopPgV5U2pFCjzBk+ReNorIq0gP0G4PtHh+ul1AHrksGX
126+
3HWtJ90xOFiPGAKopLogbC7BlMMl69zHvNWZ/DXhIpFLQN+hH515AgMBAAGjLDAq
127+
MAkGA1UdEwQCMAAwHQYDVR0OBBYEFBgSkITjAZmbgBE+4QqMjIR/BabhMA0GCSqG
128+
SIb3DQEBCwUAA4IBAQCYY1KfD/NjxaqmOzcpXeCNPuObOP1Oox1hGnlqEcIGmwib
129+
LQL8ogZBNIF5cB9MKbxNWHQ+70HUJ2xiv85L42xTuaFxmaZXfjih/5B0rAUB7nmZ
130+
d/nz33vIGea2Xvv3Ou3xntkK4L4cky7FD6rieJqodNd+DBPWxjf24yPSn+4qze1q
131+
WEKan/cwOrxMV4TVqHR1HUZnT7IFkD5gVumlOXADAsh17oPvNNgrnyd0ebxt8WkG
132+
M6Ybv7ZXvOVbzER//MRbOjoQ1BESBzh9PNPCU3av5Cbl0Nkaa1Fb3F8NzVeyWG9W
133+
EikDFNiRsLSNuyC96XUU+nJnVIyPd4aCa7/bC4OJ
134+
</X509Certificate>
135+
</X509Data>
136+
</KeyInfo>
137+
</Signature>
138+
</DTE>

‎src/tests/test_data/sii-dte/DTE--76354771-K--33--170--cleaned-mod-replaced-cert.xml

+34-47
Original file line numberDiff line numberDiff line change
@@ -70,9 +70,11 @@
7070
</Reference>
7171
</SignedInfo>
7272
<SignatureValue>
73-
fsYP5p/lNfofAz8POShrJjqXdBTNNtvv4/TWCxbvwTIAXr7BLrlvX3C/Hpfo4viqaxSu1OGFgPnk
74-
ddDIFwj/ZsVdbdB+MhpKkyha83RxhJpYBVBY3c+y9J6oMfdIdMAYXhEkFw8w63KHyhdf2E9dnbKi
75-
wqSxDcYjTT6vXsLPrZk=
73+
wwOMQuFqa6c5gzYSJ5PWfo0OiAf+yNcJK6wx4xJ3VNehlAcMrUB2q+rK/DDhCvjxAoX4NxBACiFD
74+
MrTMIfvxrwXjLd1oX37lSFOtsWX6JxL0SV+tLF7qvWCu1Yzw8ypUf7GDkbymJkoTYDF9JFF8kYU4
75+
FdU2wttiwne9XH8QFHgXsocKP/aygwiOeGqiNX9o/O5XS2GWpt+KM20jrvtYn7UFMED/3aPacCb1
76+
GABizr8mlVEZggZgJunMDChpFQyEigSXMK5I737Ac8D2bw7WB47Wj1WBL3sCFRDlXUXtnMvChBVp
77+
0HRUXYuKHyfpCzqIBXygYrIZexxXgOSnKu/yGg==
7678
</SignatureValue>
7779
<KeyInfo>
7880
<KeyValue>
@@ -87,50 +89,35 @@ Uavs/9J+gR9BBMs/eYE=
8789
</KeyValue>
8890
<X509Data>
8991
<X509Certificate>
90-
MIIIDTCCBvWgAwIBAgIQXD9eCvh/44P1ET5RI1LuJjANBgkqhkiG9w0BAQsFADBU
91-
MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVR29vZ2xlIFRydXN0IFNlcnZpY2VzMSUw
92-
IwYDVQQDExxHb29nbGUgSW50ZXJuZXQgQXV0aG9yaXR5IEczMB4XDTE5MDMyNjEz
93-
NDA0MFoXDTE5MDYxODEzMjQwMFowZjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNh
94-
bGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEzARBgNVBAoMCkdvb2ds
95-
ZSBMTEMxFTATBgNVBAMMDCouZ29vZ2xlLmNvbTBZMBMGByqGSM49AgEGCCqGSM49
96-
AwEHA0IABANpWSLXLbJm5eRzc1EJmvSIbz0nANT+b11r+XhSUCAbfQhS+4M/91YJ
97-
gVE6UtZJrLO7GGxvp1tV/DL857NaLEWjggWSMIIFjjATBgNVHSUEDDAKBggrBgEF
98-
BQcDATAOBgNVHQ8BAf8EBAMCB4AwggRXBgNVHREEggROMIIESoIMKi5nb29nbGUu
99-
Y29tgg0qLmFuZHJvaWQuY29tghYqLmFwcGVuZ2luZS5nb29nbGUuY29tghIqLmNs
100-
b3VkLmdvb2dsZS5jb22CGCouY3Jvd2Rzb3VyY2UuZ29vZ2xlLmNvbYIGKi5nLmNv
101-
gg4qLmdjcC5ndnQyLmNvbYIKKi5nZ3BodC5jboIWKi5nb29nbGUtYW5hbHl0aWNz
102-
LmNvbYILKi5nb29nbGUuY2GCCyouZ29vZ2xlLmNsgg4qLmdvb2dsZS5jby5pboIO
103-
Ki5nb29nbGUuY28uanCCDiouZ29vZ2xlLmNvLnVrgg8qLmdvb2dsZS5jb20uYXKC
104-
DyouZ29vZ2xlLmNvbS5hdYIPKi5nb29nbGUuY29tLmJygg8qLmdvb2dsZS5jb20u
105-
Y2+CDyouZ29vZ2xlLmNvbS5teIIPKi5nb29nbGUuY29tLnRygg8qLmdvb2dsZS5j
106-
b20udm6CCyouZ29vZ2xlLmRlggsqLmdvb2dsZS5lc4ILKi5nb29nbGUuZnKCCyou
107-
Z29vZ2xlLmh1ggsqLmdvb2dsZS5pdIILKi5nb29nbGUubmyCCyouZ29vZ2xlLnBs
108-
ggsqLmdvb2dsZS5wdIISKi5nb29nbGVhZGFwaXMuY29tgg8qLmdvb2dsZWFwaXMu
109-
Y26CESouZ29vZ2xlY25hcHBzLmNughQqLmdvb2dsZWNvbW1lcmNlLmNvbYIRKi5n
110-
b29nbGV2aWRlby5jb22CDCouZ3N0YXRpYy5jboINKi5nc3RhdGljLmNvbYISKi5n
111-
c3RhdGljY25hcHBzLmNuggoqLmd2dDEuY29tggoqLmd2dDIuY29tghQqLm1ldHJp
112-
Yy5nc3RhdGljLmNvbYIMKi51cmNoaW4uY29tghAqLnVybC5nb29nbGUuY29tghYq
113-
LnlvdXR1YmUtbm9jb29raWUuY29tgg0qLnlvdXR1YmUuY29tghYqLnlvdXR1YmVl
114-
ZHVjYXRpb24uY29tghEqLnlvdXR1YmVraWRzLmNvbYIHKi55dC5iZYILKi55dGlt
115-
Zy5jb22CGmFuZHJvaWQuY2xpZW50cy5nb29nbGUuY29tggthbmRyb2lkLmNvbYIb
116-
ZGV2ZWxvcGVyLmFuZHJvaWQuZ29vZ2xlLmNughxkZXZlbG9wZXJzLmFuZHJvaWQu
117-
Z29vZ2xlLmNuggRnLmNvgghnZ3BodC5jboIGZ29vLmdsghRnb29nbGUtYW5hbHl0
118-
aWNzLmNvbYIKZ29vZ2xlLmNvbYIPZ29vZ2xlY25hcHBzLmNughJnb29nbGVjb21t
119-
ZXJjZS5jb22CGHNvdXJjZS5hbmRyb2lkLmdvb2dsZS5jboIKdXJjaGluLmNvbYIK
120-
d3d3Lmdvby5nbIIIeW91dHUuYmWCC3lvdXR1YmUuY29tghR5b3V0dWJlZWR1Y2F0
121-
aW9uLmNvbYIPeW91dHViZWtpZHMuY29tggV5dC5iZTBoBggrBgEFBQcBAQRcMFow
122-
LQYIKwYBBQUHMAKGIWh0dHA6Ly9wa2kuZ29vZy9nc3IyL0dUU0dJQUczLmNydDAp
123-
BggrBgEFBQcwAYYdaHR0cDovL29jc3AucGtpLmdvb2cvR1RTR0lBRzMwHQYDVR0O
124-
BBYEFM8C2hpNgJL/BEX/yzeB408dhba2MAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgw
125-
FoAUd8K4UJpndnaxLcKG0IOgfqZ+ukswIQYDVR0gBBowGDAMBgorBgEEAdZ5AgUD
126-
MAgGBmeBDAECAjAxBgNVHR8EKjAoMCagJKAihiBodHRwOi8vY3JsLnBraS5nb29n
127-
L0dUU0dJQUczLmNybDANBgkqhkiG9w0BAQsFAAOCAQEAF9PM41ShwCbhtJG7tj2y
128-
ZvF2sHbQ5YuZrMfJc6eeCG+nCKm1U5iJzXnXctFGvfJnUCZpj9YrfwDswdEddWyZ
129-
IG6m6wONF3ZiQifQrcDi0oDA+0BwjEuzYGCGkbfE+Xxb30bVEyDRe51DpJf+cqsb
130-
+DW2pYdikbdrPem5/hwdNerc7nqrQOJ93sqwbVNGktuyJsTOGNKkSwSaejxdN7yl
131-
g5aa4CJsE94gy4+mCywWjnnsjcLGJM3RBUxDdAdTGMldU/r33HCUCXl33Qxc4nvP
132-
MlE9LyFOTIJoajWcpGOsbKWiL3Zr19DKNBSn4Xof0onbtCH7dbpyMwP8XcA2O1dA
133-
ow==
92+
MIIGVDCCBTygAwIBAgIKMUWmvgAAAAjUHTANBgkqhkiG9w0BAQUFADCB0jELMAkGA1UEBhMCQ0wx
93+
HTAbBgNVBAgTFFJlZ2lvbiBNZXRyb3BvbGl0YW5hMREwDwYDVQQHEwhTYW50aWFnbzEUMBIGA1UE
94+
ChMLRS1DRVJUQ0hJTEUxIDAeBgNVBAsTF0F1dG9yaWRhZCBDZXJ0aWZpY2Fkb3JhMTAwLgYDVQQD
95+
EydFLUNFUlRDSElMRSBDQSBGSVJNQSBFTEVDVFJPTklDQSBTSU1QTEUxJzAlBgkqhkiG9w0BCQEW
96+
GHNjbGllbnRlc0BlLWNlcnRjaGlsZS5jbDAeFw0xNzA5MDQyMTExMTJaFw0yMDA5MDMyMTExMTJa
97+
MIHXMQswCQYDVQQGEwJDTDEUMBIGA1UECBMLVkFMUEFSQUlTTyAxETAPBgNVBAcTCFF1aWxsb3Rh
98+
MS8wLQYDVQQKEyZTZXJ2aWNpb3MgQm9uaWxsYSB5IExvcGV6IHkgQ2lhLiBMdGRhLjEkMCIGA1UE
99+
CwwbSW5nZW5pZXLDrWEgeSBDb25zdHJ1Y2Npw7NuMSMwIQYDVQQDExpSYW1vbiBodW1iZXJ0byBM
100+
b3BleiAgSmFyYTEjMCEGCSqGSIb3DQEJARYUZW5hY29ubHRkYUBnbWFpbC5jb20wgZ8wDQYJKoZI
101+
hvcNAQEBBQADgY0AMIGJAoGBAKQeAbNDqfi9M2v86RUGAYgq1ZSDioFC6OLr0SwiOaYnLsSOl+Kx
102+
O394PVwSGa6rZk1ErIZonyi15fU/0nHZLi8iHLB49EB5G3tCwh0s8NfqR9ck0/3Z+TXhVUdiJyJC
103+
/z8x5I5lSUfzNEedJRidVvp6jVGr7P/SfoEfQQTLP3mBAgMBAAGjggKnMIICozA9BgkrBgEEAYI3
104+
FQcEMDAuBiYrBgEEAYI3FQiC3IMvhZOMZoXVnReC4twnge/sPGGBy54UhqiCWAIBZAIBBDAdBgNV
105+
HQ4EFgQU1dVHhF0UVe7RXIz4cjl3/Vew+qowCwYDVR0PBAQDAgTwMB8GA1UdIwQYMBaAFHjhPp/S
106+
ErN6PI3NMA5Ts0MpB7NVMD4GA1UdHwQ3MDUwM6AxoC+GLWh0dHA6Ly9jcmwuZS1jZXJ0Y2hpbGUu
107+
Y2wvZWNlcnRjaGlsZWNhRkVTLmNybDA6BggrBgEFBQcBAQQuMCwwKgYIKwYBBQUHMAGGHmh0dHA6
108+
Ly9vY3NwLmVjZXJ0Y2hpbGUuY2wvb2NzcDAjBgNVHREEHDAaoBgGCCsGAQQBwQEBoAwWCjEzMTg1
109+
MDk1LTYwIwYDVR0SBBwwGqAYBggrBgEEAcEBAqAMFgo5NjkyODE4MC01MIIBTQYDVR0gBIIBRDCC
110+
AUAwggE8BggrBgEEAcNSBTCCAS4wLQYIKwYBBQUHAgEWIWh0dHA6Ly93d3cuZS1jZXJ0Y2hpbGUu
111+
Y2wvQ1BTLmh0bTCB/AYIKwYBBQUHAgIwge8egewAQwBlAHIAdABpAGYAaQBjAGEAZABvACAARgBp
112+
AHIAbQBhACAAUwBpAG0AcABsAGUALgAgAEgAYQAgAHMAaQBkAG8AIAB2AGEAbABpAGQAYQBkAG8A
113+
IABlAG4AIABmAG8AcgBtAGEAIABwAHIAZQBzAGUAbgBjAGkAYQBsACwAIABxAHUAZQBkAGEAbgBk
114+
AG8AIABoAGEAYgBpAGwAaQB0AGEAZABvACAAZQBsACAAQwBlAHIAdABpAGYAaQBjAGEAZABvACAA
115+
cABhAHIAYQAgAHUAcwBvACAAdAByAGkAYgB1AHQAYQByAGkAbzANBgkqhkiG9w0BAQUFAAOCAQEA
116+
mxtPpXWslwI0+uJbyuS9s/S3/Vs0imn758xMU8t4BHUd+OlMdNAMQI1G2+q/OugdLQ/a9Sg3clKD
117+
qXR4lHGl8d/Yq4yoJzDD3Ceez8qenY3JwGUhPzw9oDpg4mXWvxQDXSFeW/u/BgdadhfGnpwx61Un
118+
+/fU24ZgU1dDJ4GKj5oIPHUIjmoSBhnstEhIr6GJWSTcDKTyzRdqBlaVhenH2Qs6Mw6FrOvRPuud
119+
B7lo1+OgxMb/Gjyu6XnEaPu7Vq4XlLYMoCD2xrV7WEADaDTm7KcNLczVAYqWSF1WUqYSxmPoQDFY
120+
+kMTThJyCXBlE0NADInrkwWgLLygkKI7zXkwaw==
134121
</X509Certificate>
135122
</X509Data>
136123
</KeyInfo>

‎src/tests/test_libs_xml_utils.py

+35-6
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
import lxml.etree
55

6-
from cl_sii.libs.crypto_utils import load_pem_x509_cert
6+
from cl_sii.libs.crypto_utils import _X509CertOpenSsl, load_pem_x509_cert
77
from cl_sii.libs.xml_utils import ( # noqa: F401
88
XmlElement,
99
XmlFeatureForbidden,
@@ -135,6 +135,9 @@ def setUpClass(cls) -> None:
135135
cls.with_valid_signature = read_test_file_bytes(
136136
'test_data/sii-dte/DTE--76354771-K--33--170--cleaned.xml'
137137
)
138+
cls.with_valid_signature_not_expired = read_test_file_bytes(
139+
'test_data/sii-dte/DTE--60910000-1--33--no-expired-sign.xml',
140+
)
138141
cls.with_valid_signature_signed_data = read_test_file_bytes(
139142
'test_data/sii-dte/DTE--76354771-K--33--170--cleaned-signed_data.xml'
140143
)
@@ -185,6 +188,28 @@ def test_ok_external_trusted_cert(self) -> None:
185188
signature_xml_bytes = f.getvalue()
186189
self.assertEqual(signature_xml_bytes, self.with_valid_signature_signature_xml)
187190

191+
def test_ok_external_trusted_open_ssl_cert_with_signature(self) -> None:
192+
xml_doc = parse_untrusted_xml(self.with_valid_signature)
193+
cert = load_pem_x509_cert(self.xml_doc_cert_pem_bytes)
194+
195+
open_ssl_cert = _X509CertOpenSsl.from_cryptography(cert)
196+
197+
signed_data, signed_xml, signature_xml = verify_xml_signature(
198+
xml_doc, trusted_x509_cert=open_ssl_cert
199+
)
200+
201+
self.assertEqual(signed_data, self.with_valid_signature_signed_data)
202+
203+
f = io.BytesIO()
204+
write_xml_doc(signed_xml, f)
205+
signed_xml_bytes = f.getvalue()
206+
self.assertEqual(signed_xml_bytes, self.with_valid_signature_signed_xml)
207+
208+
f = io.BytesIO()
209+
write_xml_doc(signature_xml, f)
210+
signature_xml_bytes = f.getvalue()
211+
self.assertEqual(signature_xml_bytes, self.with_valid_signature_signature_xml)
212+
188213
def test_ok_cert_in_signature(self) -> None:
189214
# TODO: implement!
190215

@@ -221,7 +246,7 @@ def test_fail_verify_with_other_cert(self) -> None:
221246
verify_xml_signature(xml_doc, trusted_x509_cert=cert)
222247
self.assertEqual(
223248
cm.exception.args,
224-
("Signature verification failed: wrong signature length",),
249+
("Signature verification failed: ",),
225250
)
226251

227252
def test_bad_cert_included(self) -> None:
@@ -244,25 +269,29 @@ def test_bad_cert_included(self) -> None:
244269
)
245270

246271
def test_fail_replaced_cert(self) -> None:
272+
"""
273+
Tests that the signature verification fails
274+
when the certificate is not the one that was used to sign the document.
275+
"""
247276
xml_doc = parse_untrusted_xml(self.with_replaced_cert)
248-
cert = load_pem_x509_cert(self.any_x509_cert_pem_file)
277+
cert = load_pem_x509_cert(self.xml_doc_cert_pem_bytes)
249278

250279
with self.assertRaises(XmlSignatureInvalid) as cm:
251280
verify_xml_signature(xml_doc, trusted_x509_cert=cert)
252281
self.assertEqual(
253282
cm.exception.args,
254-
("Signature verification failed: []",),
283+
("Signature verification failed: ",),
255284
)
256285

257286
def test_fail_included_cert_not_from_a_known_ca(self) -> None:
258-
xml_doc = parse_untrusted_xml(self.with_valid_signature)
287+
xml_doc = parse_untrusted_xml(self.with_valid_signature_not_expired)
259288

260289
# Without cert: fails because the issuer of the cert in the signature is not a known CA.
261290
with self.assertRaises(XmlSignatureInvalidCertificate) as cm:
262291
verify_xml_signature(xml_doc, trusted_x509_cert=None)
263292
self.assertEqual(
264293
cm.exception.args,
265-
('unable to get local issuer certificate',),
294+
('validation failed: Certificate is missing required extension',),
266295
)
267296

268297
def test_fail_signed_data_modified(self) -> None:

0 commit comments

Comments
 (0)