Match id attributes by local name under the shadow (#356)

The shadow's register_id validated the attribute with node.get(), which
only finds an unqualified attribute, while the fast path's xmlHasProp()
matches by local name whatever the namespace. A valid
register_id(node, "Id") for a namespaced Id could therefore raise
"missing attribute." in shadow mode only. Without id_ns the lookup now
scans the element's attribute names and compares local names, as
xmlHasProp does — and as the ID replay onto the copy already did.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: mxamin

developer.md

@@ -231,9 +231,7 @@ All invisible to the documented API:
   document until grafted;
 - `encrypted_data_ensure_key_info(ns=...)` on an existing `KeyInfo` returns
   a new element object rather than the original proxy;
-- `register_id` skips the live duplicate-id check (it runs per copy instead)
-  and, without `id_ns`, looks the attribute up namespace-strictly where the
-  raw `xmlHasProp` is namespace-agnostic;
+- `register_id` skips the live duplicate-id check (it runs per copy instead);
 - `encrypt_xml` *copies* a template that is attached inside the target tree
   rather than moving it, so it also remains at its original position;
 - signature/encryption contexts keep no live result nodes after the call

src/ds.c

@@ -119,6 +119,50 @@ static int PyXmlSec_SignatureContextKeySet(PyObject* self, PyObject* value, void
     return 0;
 }
 
+// Non-zero when `node` carries an attribute whose *local* name is `name`,
+// whatever its namespace, -1 with an exception set on failure. The fast
+// path's xmlHasProp() matches that way, while lxml's node.get(name) only
+// finds an unqualified attribute; the shadow's validation goes through this
+// so that both modes accept the same calls.
+static int PyXmlSec_LxmlHasAttrByLocalName(PyXmlSec_LxmlElementPtr node, const char* name) {
+    PyObject* keys;
+    PyObject* seq;
+    Py_ssize_t i;
+    Py_ssize_t n;
+    int found = 0;
+
+    keys = PyObject_CallMethod((PyObject*)node, "keys", NULL);
+    if (keys == NULL) {
+        return -1;
+    }
+    seq = PySequence_Fast(keys, "unexpected attribute names.");
+    Py_DECREF(keys);
+    if (seq == NULL) {
+        return -1;
+    }
+
+    n = PySequence_Fast_GET_SIZE(seq);
+    for (i = 0; i < n && !found; ++i) {
+        PyObject* key = PySequence_Fast_GET_ITEM(seq, i);  // borrowed
+        const char* local;
+        const char* end;
+        if (!PyUnicode_Check(key) || (local = PyUnicode_AsUTF8(key)) == NULL) {
+            if (!PyErr_Occurred()) {
+                PyErr_SetString(PyXmlSec_InternalError, "unexpected attribute name.");
+            }
+            Py_DECREF(seq);
+            return -1;
+        }
+        // lxml spells a namespaced attribute "{href}local".
+        if (local[0] == '{' && (end = strchr(local, '}')) != NULL) {
+            local = end + 1;
+        }
+        found = strcmp(local, name) == 0;
+    }
+    Py_DECREF(seq);
+    return found;
+}
+
 static const char PyXmlSec_SignatureContextRegisterId__doc__[] = \
     "register_id(node, id_attr = 'ID', id_ns = None) -> None\n"
     "Registers new id.\n\n"
@@ -151,27 +195,31 @@ static PyObject* PyXmlSec_SignatureContextRegisterId(PyObject* self, PyObject* a
     // whole-document shadows (sign/verify/decrypt) replay it onto their
     // private copies. The duplicate-id check runs there, per copy.
     if (PyXmlSec_LxmlShadowIsActive()) {
-        PyObject* key;
-        PyObject* value;
+        int found;
         if (id_ns != NULL) {
-            key = PyUnicode_FromFormat("{%s}%s", id_ns, id_attr);
+            PyObject* key = PyUnicode_FromFormat("{%s}%s", id_ns, id_attr);
+            PyObject* value;
+            if (key == NULL) {
+                goto ON_FAIL;
+            }
+            value = PyObject_CallMethod((PyObject*)node, "get", "O", key);
+            Py_DECREF(key);
+            if (value == NULL) {
+                goto ON_FAIL;
+            }
+            found = value != Py_None;
+            Py_DECREF(value);
         } else {
-            key = PyUnicode_FromString(id_attr);
-        }
-        if (key == NULL) {
-            goto ON_FAIL;
-        }
-        value = PyObject_CallMethod((PyObject*)node, "get", "O", key);
-        Py_DECREF(key);
-        if (value == NULL) {
-            goto ON_FAIL;
+            // As xmlHasProp() does on the fast path: by local name.
+            found = PyXmlSec_LxmlHasAttrByLocalName(node, id_attr);
+            if (found < 0) {
+                goto ON_FAIL;
+            }
         }
-        if (value == Py_None) {
-            Py_DECREF(value);
+        if (!found) {
             PyErr_SetString(PyXmlSec_Error, "missing attribute.");
             goto ON_FAIL;
         }
-        Py_DECREF(value);
         if (PyXmlSec_LxmlShadowRecordId(node, id_attr, id_ns) < 0) {
             goto ON_FAIL;
         }

tests/test_ds.py

@@ -55,6 +55,14 @@ def test_register_id_bad_args(self):
         with self.assertRaises(TypeError):
             ctx.register_id('')
 
+    def test_register_id_matches_namespaced_attribute_by_local_name(self):
+        """Should accept a namespaced id attribute when no id_ns is given, as xmlHasProp does."""
+        ctx = xmlsec.SignatureContext()
+        root = self.load_xml('sign_template.xml')
+        sign = xmlsec.template.create(root, consts.TransformExclC14N, consts.TransformRsaSha1)
+        sign.set('{http://www.example.org/ns}Id', 'sig-1')
+        ctx.register_id(sign, 'Id')
+
     def test_register_id_with_namespace_without_attribute(self):
         ctx = xmlsec.SignatureContext()
         root = self.load_xml('sign_template.xml')