pennylane-hq · fauresebast · Sep 2, 2025 · Sep 2, 2025
diff --git a/lib/xmldsig.rb b/lib/xmldsig.rb
@@ -26,6 +26,7 @@ class SchemaError < Error
 require "xmldsig/transforms/canonicalize"
 require "xmldsig/transforms/enveloped_signature"
 require "xmldsig/transforms/xpath"
+require "xmldsig/transforms/attachment_content_signature"
 require "xmldsig/transforms"
 require "xmldsig/reference"
 require "xmldsig/signature"
diff --git a/lib/xmldsig/transforms.rb b/lib/xmldsig/transforms.rb
@@ -23,6 +23,8 @@ def get_transform(node, transform_node)
           Transforms::Canonicalize.new(node, transform_node, true)
         when "http://www.w3.org/TR/1999/REC-xpath-19991116"
           Transforms::XPath.new(node, transform_node)
+        when "http://docs.oasis-open.org/wss/oasis-wss-SwAProfile-1.1#Attachment-Content-Signature-Transform"
+          Transforms::AttachmentContentSignature.new(node, transform_node)
       end
     end
 

diff --git a/lib/xmldsig/transforms/attachment_content_signature.rb b/lib/xmldsig/transforms/attachment_content_signature.rb
@@ -0,0 +1,9 @@
+module Xmldsig
+  class Transforms < Array
+    class AttachmentContentSignature < Transform
+      def transform
+        node
+      end
+    end
+  end
+end
diff --git a/spec/fixtures/unsigned_attachment_content_signature.xml b/spec/fixtures/unsigned_attachment_content_signature.xml
@@ -0,0 +1,154 @@
+<?xml version="1.0"?>
+<S12:Envelope xmlns:S12="http://www.w3.org/2003/05/soap-envelope">
+  <S12:Header>
+    <wsse:Security
+      xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
+      xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
+      S12:mustUnderstand="true">
+      <wsse:BinarySecurityToken
+        EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
+        ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
+        wsu:Id="1439af8d-6e9d-40f2-85b2-83837f516ff7">
+        MIICgjCCAeugAwIBAgIBADANBgkqhkiG9w0BAQUFADA6MQswCQYDVQQGEwJCRTENMAsGA1UECgwEVGVzdDENMAsGA1UECwwEVGVzdDENMAsGA1UEAwwEVGVzdDAeFw0xMzAxMTMxNTMzNDNaFw0xNDAxMTMxNTMzNDNaMDoxCzAJBgNVBAYTAkJFMQ0wCwYDVQQKDARUZXN0MQ0wCwYDVQQLDARUZXN0MQ0wCwYDVQQDDARUZXN0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC37C0mhTmdr8iVfQPQuOKtzG/fhwG4ILuUX1Vk5uN9oSZJxhb5Kn8aBppny1BSekgk12wn4AE/6i7Jfix3SZWoqdaxpdDalvQSdNeyn6GmV2oP4lzp6XjXmtRxvOywgTYuhf/DBlpiq7B/vTF7kMwYgs0ahM3mRJG2V7LARTXUfwIDAQABo4GXMIGUMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFBRkMx3ZwHO3Zog0pWdYNB38NRmWMGIGA1UdIwRbMFmAFBRkMx3ZwHO3Zog0pWdYNB38NRmWoT6kPDA6MQswCQYDVQQGEwJCRTENMAsGA1UECgwEVGVzdDENMAsGA1UECwwEVGVzdDENMAsGA1UEAwwEVGVzdIIBADANBgkqhkiG9w0BAQUFAAOBgQBs8voSBDgN7HL1i5EP+G/ymWUVenpGvRZCnfkR9Wo4ORzj1Y7ohXHooOzDJ2oi0yDwatXnPpe3hauqQDid6d4i7F1Wpgdo2MibqXP8/DPzhuBARvPSzip+yS6ITjqKN/YN4K+kpja2Sh7DdxWND3opvVHZTXywjZpdF1OsmNhOCg==
+      </wsse:BinarySecurityToken>
+      <xenc:EncryptedKey xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
+        Id="EK-9d6868b8-80fd-46b9-9d22-b14e5c1e9ab9">
+        <xenc:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#rsa-oaep">
+          <ds:DigestMethod xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+            Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
+          <xenc11:MGF xmlns:xenc11="http://www.w3.org/2009/xmlenc11#"
+            Algorithm="http://www.w3.org/2009/xmlenc11#mgf1sha256" />
+        </xenc:EncryptionMethod>
+        <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+          <wsse:SecurityTokenReference>
+            <wsse:Reference URI="#1439af8d-6e9d-40f2-85b2-83837f516ff7"
+              ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" />
+          </wsse:SecurityTokenReference>
+        </ds:KeyInfo>
+        <xenc:CipherData>
+          <xenc:CipherValue>
+            0qRAwgKOj3u4RmdwXaJ3mYppqt6GeWDmnyzb0P+XPc4ixoXoiNKLJopxVqknNBWnBqyLXWRkb+k2W9lKPi6cV5WeeK3UMfYoc8V/QhnGeQELDNe+Inq05SWMKVRvIRQWg+FEriEjRGMqzqWcS4i2aC4azp4KBE43xCXbdYmVjvU0YiTlD5SODUepK6Q5jyiF/sU6Tvc5Si6WVFzYb3ZnZzsopmF9ICmuk7K5PWeaT63StwyL27f8STl0+AgMsbCGK4bK4aJRLrJwo5A9Bm2FnNSJwQgDUPePote2DVG4B+Z6rrP3MYBxtvaeIJhEUpZlaeM6G3u3ImIMQwCVNiYGwA==</xenc:CipherValue>
+        </xenc:CipherData>
+        <xenc:ReferenceList>
+          <xenc:DataReference URI="#ED-e9b3dc24-f87b-4e65-b5a0-4f1c7872d292" />
+        </xenc:ReferenceList>
+      </xenc:EncryptedKey>
+      <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
+        Id="ED-e9b3dc24-f87b-4e65-b5a0-4f1c7872d292" MimeType="application/gzip"
+        Type="http://docs.oasis-open.org/wss/oasis-wss-SwAProfile-1.1#Attachment-Content-Only">
+        <xenc:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes128-gcm" />
+        <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+          <wsse:SecurityTokenReference
+            xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"
+            wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey">
+            <wsse:Reference URI="#EK-9d6868b8-80fd-46b9-9d22-b14e5c1e9ab9" />
+          </wsse:SecurityTokenReference>
+        </ds:KeyInfo>
+        <xenc:CipherData>
+          <xenc:CipherReference URI="cid:att-0d2ea038-63a7-4f1d-81a5-77090f787203@cid">
+            <xenc:Transforms>
+              <ds:Transform xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+                Algorithm="http://docs.oasis-open.org/wss/oasis-wss-SwAProfile-1.1#Attachment-Ciphertext-Transform" />
+            </xenc:Transforms>
+          </xenc:CipherReference>
+        </xenc:CipherData>
+      </xenc:EncryptedData>
+      <wsse:BinarySecurityToken
+        EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary"
+        ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"
+        wsu:Id="X509-d7c8ddd1-c7cc-4102-a377-8ad51e5e646a">
+        MIICgjCCAeugAwIBAgIBADANBgkqhkiG9w0BAQUFADA6MQswCQYDVQQGEwJCRTENMAsGA1UECgwEVGVzdDENMAsGA1UECwwEVGVzdDENMAsGA1UEAwwEVGVzdDAeFw0xMzAxMTExNTI4MzdaFw0xNDAxMTExNTI4MzdaMDoxCzAJBgNVBAYTAkJFMQ0wCwYDVQQKDARUZXN0MQ0wCwYDVQQLDARUZXN0MQ0wCwYDVQQDDARUZXN0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQnLpvMvXoPGcAsdk2j2AeLLPysVtFc1f6CSGAfiIR2dzs8h/MN5R0bFBASDUGUGdYyr0QGcKNtqW/cd3Sr1rS2fh5Bopnq9YS6od6J6P3AGIKwmJuIBwwfsvnX3eKGDYeOqmrIo5mdPRAob2D1+FhXbMxeYbRhGMmItC0dle7LQIDAQABo4GXMIGUMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFM7pPtefOj5Og5wLqI0Lt5UUmw0uMGIGA1UdIwRbMFmAFM7pPtefOj5Og5wLqI0Lt5UUmw0uoT6kPDA6MQswCQYDVQQGEwJCRTENMAsGA1UECgwEVGVzdDENMAsGA1UECwwEVGVzdDENMAsGA1UEAwwEVGVzdIIBADANBgkqhkiG9w0BAQUFAAOBgQBTIt/4/sraPO4gmmY2oSGG19I2Fs24pV/bX8xqI10iexpGsxnpCQIeiDTUHamo12vyXDPx8zANdVThFSAWHEESBMLrS8pybbAL7sU4ij4JmfxygGk6OEsc3jKY00NYom+Mg3JObIgtjOIKYfrH7uvpm+AIXsef5vrst4MI6GhEAA==
+      </wsse:BinarySecurityToken>
+      <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+        Id="SIG-08294983-db0e-4618-8fd5-bde8fbaf7fbe">
+        <ds:SignedInfo>
+          <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
+            <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"
+              PrefixList="S12" />
+          </ds:CanonicalizationMethod>
+          <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
+          <ds:Reference URI="#msg-531a181a-0850-44d9-9511-a37ac9e9da2d">
+            <ds:Transforms>
+              <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
+                <ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"
+                  PrefixList="S12" />
+              </ds:Transform>
+            </ds:Transforms>
+            <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
+            <ds:DigestValue></ds:DigestValue>
+          </ds:Reference>
+          <ds:Reference URI="#id-72e87a8d-9227-4a28-91fe-9ab03afe2e47">
+            <ds:Transforms>
+              <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+            </ds:Transforms>
+            <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
+            <ds:DigestValue></ds:DigestValue>
+          </ds:Reference>
+          <ds:Reference URI="cid:att-0d2ea038-63a7-4f1d-81a5-77090f787203@cid">
+            <ds:Transforms>
+              <ds:Transform
+                Algorithm="http://docs.oasis-open.org/wss/oasis-wss-SwAProfile-1.1#Attachment-Content-Signature-Transform" />
+            </ds:Transforms>
+            <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
+            <ds:DigestValue></ds:DigestValue>
+          </ds:Reference>
+        </ds:SignedInfo>
+        <ds:SignatureValue></ds:SignatureValue>
+        <ds:KeyInfo Id="KI-3d6736dd-2beb-4b7c-8227-137ec2eb235e">
+          <wsse:SecurityTokenReference wsu:Id="STR-86dd8d90-1be1-41e2-8479-c7635bf1f93f">
+            <wsse:Reference URI="#X509-d7c8ddd1-c7cc-4102-a377-8ad51e5e646a"
+              ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" />
+          </wsse:SecurityTokenReference>
+        </ds:KeyInfo>
+      </ds:Signature>
+    </wsse:Security>
+    <eb:Messaging xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+      xmlns:eb="http://docs.oasis-open.org/ebxml-msg/ebms/v3.0/ns/core/200704/"
+      xmlns:ebbp="http://docs.oasis-open.org/ebxml-bp/ebbp-signals-2.0"
+      xmlns:ebbpsig="http://docs.oasis-open.org/ebxml-bp/ebbp-signals-2.0"
+      xmlns:ns2="http://schemas.xmlsoap.org/soap/envelope/"
+      xmlns:ns3="http://www.w3.org/2003/05/soap-envelope"
+      xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
+      xmlns:xlink="http://www.w3.org/1999/xlink" wsu:Id="msg-531a181a-0850-44d9-9511-a37ac9e9da2d"
+      ns3:mustUnderstand="true">
+      <eb:UserMessage>
+        <eb:MessageInfo>
+          <eb:Timestamp>2025-09-01T10:31:52Z</eb:Timestamp>
+          <eb:MessageId>[email protected]</eb:MessageId>
+        </eb:MessageInfo>
+        <eb:PartyInfo>
+          <eb:From>
+            <eb:PartyId type="urn:fdc:peppol.eu:2017:identifiers:ap">POP002348</eb:PartyId>
+            <eb:Role>http://docs.oasis-open.org/ebxml-msg/ebms/v3.0/ns/core/200704/initiator</eb:Role>
+          </eb:From>
+          <eb:To>
+            <eb:PartyId type="urn:fdc:peppol.eu:2017:identifiers:ap">PGD000005</eb:PartyId>
+            <eb:Role>http://docs.oasis-open.org/ebxml-msg/ebms/v3.0/ns/core/200704/responder</eb:Role>
+          </eb:To>
+        </eb:PartyInfo>
+        <eb:CollaborationInfo>
+          <eb:AgreementRef>urn:fdc:peppol.eu:2017:agreements:tia:ap_provider</eb:AgreementRef>
+          <eb:Service type="cenbii-procid-ubl">urn:peppol:france:billing:regulated</eb:Service>
+          <eb:Action>
+            urn:oasis:names:specification:ubl:schema:xsd:Invoice-2::Invoice##urn:cen.eu:en16931:2017#compliant#urn:fdc:peppol.eu:2017:poacc:billing:3.0::2.1</eb:Action>
+          <eb:ConversationId>Test@Conv-26db4588-a8af-4518-a562-ebaffb9b9ed9</eb:ConversationId>
+        </eb:CollaborationInfo>
+        <eb:MessageProperties>
+          <eb:Property name="originalSender" type="iso6523-actorid-upis">0002:TEST</eb:Property>
+          <eb:Property name="finalRecipient" type="iso6523-actorid-upis">9922:NGTBCNTRLP1001</eb:Property>
+        </eb:MessageProperties>
+        <eb:PayloadInfo>
+          <eb:PartInfo href="cid:att-0d2ea038-63a7-4f1d-81a5-77090f787203@cid">
+            <eb:PartProperties>
+              <eb:Property name="MimeType">application/xml</eb:Property>
+              <eb:Property name="CompressionType">application/gzip</eb:Property>
+            </eb:PartProperties>
+          </eb:PartInfo>
+        </eb:PayloadInfo>
+      </eb:UserMessage>
+    </eb:Messaging>
+  </S12:Header>
+  <S12:Body
+    xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
+    wsu:Id="id-72e87a8d-9227-4a28-91fe-9ab03afe2e47" />
+</S12:Envelope>
diff --git a/spec/lib/xmldsig/transforms/attachment_content_signature_spec.rb b/spec/lib/xmldsig/transforms/attachment_content_signature_spec.rb
@@ -0,0 +1,14 @@
+require 'spec_helper'
+require 'byebug'
+
+describe Xmldsig::Transforms::AttachmentContentSignature do
+  let(:unsigned_xml) { File.read('spec/fixtures/unsigned_attachment_content_signature.xml') }
+  let(:unsigned_document) { Xmldsig::SignedDocument.new(unsigned_xml) }
+
+  let(:transform_node) { unsigned_document.signatures.first.references[2].transforms[0] }
+  subject(:attachment_content_transform) { described_class.new(unsigned_document.document, transform_node) }
+
+  it 'returns the node' do
+    expect(attachment_content_transform.transform).to eq(unsigned_document.document)
+  end
+end