pjfanning opened a new pull request, #1475:
URL: https://github.com/apache/poi/pull/1475
Follow-up to #1467.
- #1467 changed the transform to match `Relationship` elements with
`getElementsByTagNameNS("*", ...)`, but `PackageRelationshipCollection` only
reads elements in the relationships namespace
(`PackageNamespaces.RELATIONSHIPS`), which is also how the spec defines a
relationship. The transform now uses the same namespace. Before, an element in
another namespace that happened to be named `Relationship` and carried a signed
Id went into the digest, so a valid signature failed to verify. That could only
cause false failures, never false passes.
- The comment now says which case keeping every element covers: a duplicate
of a signed Id.
- The tests share a `modifySignedDocx` helper. The new
`testForeignRelationshipElementIsIgnored` adds `<y:Relationship xmlns:y="urn:y"
Id="rId1" .../>` to `_rels/.rels` and checks that the document is unchanged and
the signature still verifies. It fails without the change.
`TestSignatureInfo` passes locally.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
