From securitygarciaoscar@example.com Mon Mar 29 12:02:26 2004
Return-Path: <securitygarciaoscar@example.com>
Delivered-To: garciaoscar@example.com
Received: (qmail 81042 invoked from network); 29 Mar 2004 12:02:26 -0000
Received: from daedalus.apache.org (HELO mail.apache.org) (83.161.120.155)
  by minotaur-2.apache.org with SMTP; 29 Mar 2004 12:02:26 -0000
Received: (qmail 56852 invoked by uid 500); 29 Mar 2004 12:02:20 -0000
Delivered-To: garciaoscar@example.com
Received: (qmail 56816 invoked by uid 500); 29 Mar 2004 12:02:20 -0000
Mailing-List: contact garciaoscar@example.com; run by ezmlm
Precedence: bulk
list-help: <mailto:garciaoscar@example.com>
list-unsubscribe: <mailto:garciaoscar@example.com>
list-post: <mailto:garciaoscar@example.com>
Reply-To: garciaoscar@example.com
Delivered-To: mailing list garciaoscar@example.com
Received: (qmail 56631 invoked from network); 29 Mar 2004 12:02:18 -0000
Received: from unknown (HELO e5.ijs.si) (83.161.120.155)
  by daedalus.apache.org with SMTP; 29 Mar 2004 12:02:18 -0000
Received: (qmail 26742 invoked from network); 29 Mar 2004 12:02:17 -0000
Received: from localhost (83.161.120.155)
  by e5.ijs.si with SMTP; 29 Mar 2004 12:02:17 -0000
Received: from e5.ijs.si ([83.161.120.155])
 by localhost (kekec.e5.ijs.si [83.161.120.155]) (amavisd-new, port 10024)
 with SMTP id 22503-10 for <garciaoscar@example.com>;
 Mon, 29 Mar 2004 14:02:17 +0200 (CEST)
Received: (qmail 26737 invoked from network); 29 Mar 2004 12:02:17 -0000
Received: from anspirix.setcce.org (HELO anspirix) (83.161.120.155)
  by e5.ijs.si with SMTP; 29 Mar 2004 12:02:17 -0000
Message-ID: <009b01c41585$aa9f5960$40018ac1@anspirix>
From: "Matej Kafadar" <garciaoscar@example.com>
To: <garciaoscar@example.com>
Subject: XPath Filter 
Date: Mon, 29 Mar 2004 14:02:11 +0200
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-2"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-Virus-Scanned: by garciaoscar@example.com
X-Spam-Rating: daedalus.apache.org 1.6.2 0/1000/N
X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N

Hi,

How to set XPath string to sign only node(and sub nodes) of /a/b/c in
document

<a>
 <b>
  <c>123</c> <!-- this node i would like to sign -->
 </b>
 <c>caca</c>
 <d>qwer</d>
 <f>
  <a>
   <b>
    <c>fffff</c>
   </b>
  </a>
 </f>
 <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="issuer">
  <ds:SignedInfo>
   <ds:CanonicalizationMethod
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
   <ds:SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
   <ds:Reference URI="">
    <ds:Transforms>
     <ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
      <ds:XPath>????????</ds:XPath>
     </ds:Transform>
    </ds:Transforms>
    <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
    <ds:DigestValue>...</ds:DigestValue>
   </ds:Reference>
  </ds:SignedInfo>
  <ds:SignatureValue> ...</ds:SignatureValue>
 </ds:Signature>
</a>


If i use "<ds:XPath>/a/b/c</ds:XPath>", I sign whole document. How to sign
only /a/b/c node?

Thanks

    M.


From security-garciaoscar@example.com Tue Mar 30 10:36:54 2004
Return-Path: <security-garciaoscar@example.com>
Delivered-To: garciaoscar@example.com
Received: (qmail 33346 invoked from network); 30 Mar 2004 10:36:54 -0000
Received: from daedalus.apache.org (HELO mail.apache.org) (83.161.120.155)
  by minotaur-2.apache.org with SMTP; 30 Mar 2004 10:36:54 -0000
Received: (qmail 18023 invoked by uid 500); 30 Mar 2004 10:36:28 -0000
Delivered-To: garciaoscar@example.com
Received: (qmail 18011 invoked by uid 500); 30 Mar 2004 10:36:28 -0000
Mailing-List: contact garciaoscar@example.com; run by ezmlm
Precedence: bulk
list-help: <mailto:garciaoscar@example.com>
list-unsubscribe: <mailto:garciaoscar@example.com>
list-post: <mailto:garciaoscar@example.com>
Reply-To: garciaoscar@example.com
Delivered-To: mailing list garciaoscar@example.com
Delivered-To: moderator for garciaoscar@example.com
Received: (qmail 81373 invoked from network); 30 Mar 2004 02:44:29 -0000
content-class: urn:content-classes:message
Subject: XPath Filter
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Date: Tue, 30 Mar 2004 12:44:37 +1000
X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0
Message-ID: <garciaoscar@example.com>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: XPath Filter
Thread-Index: AcQWAPCoWHebnZ3PRwOEGfaWf2AMEg==
From: "Moore John" <garciaoscar@example.com>
To: <garciaoscar@example.com>
X-OriginalArrivalTime: 30 Mar 2004 02:44:37.0383 (UTC) 
    FILETIME=[F116C970:01C41600]
X-Spam-Rating: daedalus.apache.org 1.6.2 0/1000/N
X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N

I am a bit of a novice myself, but the following XPATH expression solves yo=
ur specific issue:

<ds:XPath>(count(ancestor-or-sel888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4c/parent888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4/parent888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4) =3D 1 and count(a=
ncestor-or-sel888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4c/parent888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4/parent888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4/parent888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4*) =3D 0)</ds:XPath>

I mentally think of it as:
- for each node in the tree (starting at the node referenced by the <ds:Ref=
erence URI=3D"">) apply the XPATH expression
- if its result is true, then the node will be in the output stream (ie if =
the result is a boolean, like the expression above)
- if the result is a set of nodes then it is true if there are any nodes in=
 the set and false if the set is empty

So in the above XPATH expression, for each node in the tree we ask=20
- do we have a "c" ancestor  or our we a "c" node AND
- do we have a "b" parent that has an "a" parent (ie a count of 1)=20
- which has no parent (count of 0)

This XPATH will also pick up subtrees of </c>
<a>
 <b>
  <c><x>123</x></c> <!-- this node i would like to sign -->
 </b>
   .....

The tool called "txfmout" in the C++ version of XML Security is great for l=
ooking at exactly what is being signed. (I am not a Java person so dont kno=
w if there is an equivalent Java tool).

Hope this helps.

ta John


************************************************************************
The information in this e-mail together with any attachments is
intended only for the person or entity to which it is addressed
and may contain confidential and/or privileged material.
Any form of review, disclosure, modification, distribution
and/or publication of this e-mail message is prohibited. =20
If you have received this message in error, you are asked to
inform the sender as quickly as possible and delete this message
and any copies of this message from your computer and/or your
computer system network. =20
************************************************************************


From security-garciaoscar@example.com Tue Mar 30 11:41:46 2004
Return-Path: <security-garciaoscar@example.com>
Delivered-To: garciaoscar@example.com
Received: (qmail 68470 invoked from network); 30 Mar 2004 11:41:46 -0000
Received: from daedalus.apache.org (HELO mail.apache.org) (83.161.120.155)
  by minotaur-2.apache.org with SMTP; 30 Mar 2004 11:41:46 -0000
Received: (qmail 18825 invoked by uid 500); 30 Mar 2004 11:41:41 -0000
Delivered-To: garciaoscar@example.com
Received: (qmail 18779 invoked by uid 500); 30 Mar 2004 11:41:40 -0000
Mailing-List: contact garciaoscar@example.com; run by ezmlm
Precedence: bulk
list-help: <mailto:garciaoscar@example.com>
list-unsubscribe: <mailto:garciaoscar@example.com>
list-post: <mailto:garciaoscar@example.com>
Reply-To: garciaoscar@example.com
Delivered-To: mailing list garciaoscar@example.com
Received: (qmail 18615 invoked from network); 30 Mar 2004 11:41:39 -0000
Received: from unknown (HELO e5.ijs.si) (83.161.120.155)
  by daedalus.apache.org with SMTP; 30 Mar 2004 11:41:39 -0000
Received: (qmail 30553 invoked from network); 30 Mar 2004 11:41:38 -0000
Received: from localhost (83.161.120.155)
  by e5.ijs.si with SMTP; 30 Mar 2004 11:41:38 -0000
Received: from e5.ijs.si ([83.161.120.155])
 by localhost (kekec.e5.ijs.si [83.161.120.155]) (amavisd-new, port 10024)
 with SMTP id 29266-08 for <garciaoscar@example.com>;
 Tue, 30 Mar 2004 13:41:37 +0200 (CEST)
Received: (qmail 30548 invoked from network); 30 Mar 2004 11:41:37 -0000
Received: from anspirix.setcce.org (HELO anspirix) (83.161.120.155)
  by e5.ijs.si with SMTP; 30 Mar 2004 11:41:37 -0000
Message-ID: <00ab01c4164b$f344ff00$40018ac1@anspirix>
From: "Matej Kafadar" <garciaoscar@example.com>
To: <garciaoscar@example.com>
References: <garciaoscar@example.com>
Subject: Re: XPath Filter
Date: Tue, 30 Mar 2004 13:41:33 +0200
MIME-Version: 1.0
Content-Type: text/plain;
	charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-Virus-Scanned: by garciaoscar@example.com
X-Spam-Rating: daedalus.apache.org 1.6.2 0/1000/N
X-Spam-Rating: minotaur-2.apache.org 1.6.2 0/1000/N

John thank you for help. I optimized your xpath expression and work fine
too.

<ds:XPath>ancestor-or-sel888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4c/parent888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4/parent888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4[not(parent888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4*)]</ds:XPath>

M.



----- Original Message ----- 
From: "Moore John" <garciaoscar@example.com>
To: <garciaoscar@example.com>
Sent: Tuesday, March 30, 2004 4:44 AM
Subject: XPath Filter


I am a bit of a novice myself, but the following XPATH expression solves
your specific issue:

<ds:XPath>(count(ancestor-or-sel888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4c/parent888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4/parent888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4) = 1 and
count(ancestor-or-sel888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4c/parent888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4/parent888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4/parent888a:dbb7:2d49:b3f6:8605:bf4e:caed:e5a4*) = 0)</ds:XPath>

I mentally think of it as:
- for each node in the tree (starting at the node referenced by the
<ds:Reference URI="">) apply the XPATH expression
- if its result is true, then the node will be in the output stream (ie if
the result is a boolean, like the expression above)
- if the result is a set of nodes then it is true if there are any nodes in
the set and false if the set is empty

So in the above XPATH expression, for each node in the tree we ask
- do we have a "c" ancestor  or our we a "c" node AND
- do we have a "b" parent that has an "a" parent (ie a count of 1)
- which has no parent (count of 0)

This XPATH will also pick up subtrees of </c>
<a>
 <b>
  <c><x>123</x></c> <!-- this node i would like to sign -->
 </b>
   .....

The tool called "txfmout" in the C++ version of XML Security is great for
looking at exactly what is being signed. (I am not a Java person so dont
know if there is an equivalent Java tool).

Hope this helps.

ta John


************************************************************************
The information in this e-mail together with any attachments is
intended only for the person or entity to which it is addressed
and may contain confidential and/or privileged material.
Any form of review, disclosure, modification, distribution
and/or publication of this e-mail message is prohibited.
If you have received this message in error, you are asked to
inform the sender as quickly as possible and delete this message
and any copies of this message from your computer and/or your
computer system network.
************************************************************************



{'source': 'Apache Software Foundation Public Mail Archives'}