Issue with Signature Verification When 'Transforms' Tag is Absent in 'Reference' Element #378
Description
Good Day
I have this signture on a XML Document that it content has been deliberately modified to fail the verification
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<Reference URI="#T33F19384429">
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue>uU+OaebbefWVOIXXP4q8FV7F9JQ=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>q7ENUbjtG9WauSnjDM7jwDePwnQVVeQDrsaL6ZitDLfJ+dtPi833JubqjD4on8TU+xSDAjVHYV9s
EByiiOvWLw981QICjG3g+N8AA2xpjx8nZhbZDIXvkFKmFsaII651Te/Pe+qYH6ONUYWs6Hf9cCnx
933q9A/YanGR4bRfWhyxMXyRKe+rysDCOZA/7gx2jclnaDkGVcC4Cfe28cxaHVw9xDMMZk0MEroQ
YvkJ1BttKHx8BfjIaT17aands2rW6meUH5etkMEoET19QCZO4Ez/7PI7Xr379azgrqX9QuBr+Lg9
nIGjS0Iz7E7AUgaHz6fErYug7P4/PEcNN8uAZQ==</SignatureValue>
.....
</Signature>As the Reference tag does not contain a Transforms tag, when I apply the checkSignature function to that document, the result is true. However, this is due to the function performing verification solely on the signature's digest, without recalculating the digest itself.
To reproduce the problem, take any verified document that doesn't has the Transforms tag, and then make any modification to the content that would cause the digest calculation to fail to match the original. You'll observe that the signature is still verified.
Let me know if I need to provide more details