feat(xmldsig): complete transform coverage - #103
Conversation
|
Important Review skippedReview was skipped as selected files did not have any reviewable changes. 💤 Files selected but had no reviewable changes (1)
⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe change adds Base64, XPath 1.0, and XPath Filter 2.0 XMLDSig transforms, exact node-set tracking, visibility-aware canonicalization, configurable ChangesXMLDSig transform and canonicalization flow
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant Reference
participant parse_transforms
participant execute_transforms_with_options
participant XPathEngine
participant NodeSet
participant canonicalize_with_visibility
participant VerifyContext
Reference->>parse_transforms: parse Base64/XPath/XPathFilter2
VerifyContext->>execute_transforms_with_options: execute with TransformOptions
execute_transforms_with_options->>XPathEngine: evaluate XPath or Filter 2.0
XPathEngine->>NodeSet: project selected nodes
execute_transforms_with_options->>canonicalize_with_visibility: canonicalize visible nodes
canonicalize_with_visibility-->>VerifyContext: return pre-digest bytes
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
| Filename | Overview |
|---|---|
| src/c14n/serialize.rs | Adds exact node visibility, orphan axis processing, document separators, and revised XML attribute inheritance. |
| src/c14n/ns_common.rs | Tracks visible namespace bindings separately from source namespace scope. |
| src/c14n/ns_exclusive.rs | Adds namespace visibility and binding reconciliation for exclusive canonicalization. |
| src/c14n/xml_base.rs | Limits C14N 1.1 XML base fixup to contiguous omitted ancestors. |
| src/xmldsig/xpath.rs | Implements bounded XPath evaluation, XMLDSig functions, namespace handling, and exact node projection. |
| src/xmldsig/transforms.rs | Adds Base64 and XPath transform execution across binary and node-set inputs. |
| src/xmldsig/types.rs | Adds exact axis-node membership, materialization limits, and subtree exclusion. |
| src/xmldsig/builder.rs | Aligns template validation and transform limits with parsing and execution. |
| Cargo.toml | Adds safe-Rust SXD dependencies to the XMLDSig feature. |
Reviews (19): Last reviewed commit: "fix(xmldsig): bound xpath mirror storage" | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/xmldsig/types.rs`:
- Around line 252-263: Restore set.with_comments to the requested with_comments
value after insert_subtree and comment filtering in collect_document, so
materializing nodes cannot override the caller’s setting. Preserve the existing
removal of comment Tree keys when comments are disabled and ensure
entire_document_without_comments() reports with_comments() == false.
In `@tests/c14n_golden.rs`:
- Around line 288-372: Update
merlin_xpath_subset_and_signed_info_match_all_28_golden_outputs so the final
signed_info_output comparison does not assert before the accumulated failures
are reported. Add any SignedInfo mismatch to the existing failures list with
consistent diagnostic context, or otherwise defer that assertion until after the
per-reference failures check, ensuring all mismatches are surfaced together.
In `@tests/xpath_transform_integration.rs`:
- Around line 1-12: Add end-to-end signing and verification cases in the
integration tests for plain Transform::XPath and XPathFilterOperation::Union,
alongside the existing XPathFilter2 Intersect/Subtract coverage. Reuse the
established fixtures, builders, and verification flow so both missing transform
cases are exercised without changing existing coverage.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: b254107a-d800-4c2d-a4d0-e8f72b84b1da
📒 Files selected for processing (27)
Cargo.tomlREADME.mdsrc/c14n/mod.rssrc/c14n/ns_common.rssrc/c14n/ns_exclusive.rssrc/c14n/ns_inclusive.rssrc/c14n/serialize.rssrc/c14n/xml_base.rssrc/xmldsig/builder.rssrc/xmldsig/mod.rssrc/xmldsig/parse.rssrc/xmldsig/transforms.rssrc/xmldsig/types.rssrc/xmldsig/verify.rssrc/xmldsig/xpath.rstests/base64_transform_integration.rstests/c14n_golden.rstests/donor_negative_vectors.rstests/fixtures/xmldsig/README.mdtests/fixtures/xmldsig/merlin-xpath-filter2/sign-spec-subset.xmltests/fixtures/xmldsig/phaos-xmldsig-three/certs/rsa-ca-cert.dertests/fixtures/xmldsig/phaos-xmldsig-three/certs/rsa-cert.dertests/fixtures_smoke.rstests/signature_builder.rstests/xmlsec1_interop.rstests/xpath_donor_vectors.rstests/xpath_transform_integration.rs
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 335a8cc3b9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Prove that selected attributes and namespaces emit no bytes when their owner element is absent from the canonical subset.
This reverts commit cac91b4.
- Default here() to the XMLDSig XPath parameter element - Add explicit libxmlsec Transform-node compatibility to sign and verify - Preserve comment exclusion metadata while materializing node sets
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b1315dc17b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/xmldsig/transforms.rs (1)
326-349: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winReuse the shared XML-base64 normalization helper.
append_normalized_base64duplicates the same space/tab/CR/LF-only normalization policy fromsrc/xmldsig/whitespace.rs. Extract a shared byte-oriented helper usable fromtransforms.rsandverify.rs, and call it from the Base64 transform path.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/xmldsig/transforms.rs` around lines 326 - 349, Move the shared space/tab/CR/LF Base64 normalization logic from append_normalized_base64 into a reusable byte-oriented helper in xmldsig::whitespace, preserving invalid-byte rejection and error behavior. Update the Base64 transform path and verify.rs callers to use that helper, then remove the duplicate local implementation from transforms.rs.Source: Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@src/xmldsig/transforms.rs`:
- Around line 326-349: Move the shared space/tab/CR/LF Base64 normalization
logic from append_normalized_base64 into a reusable byte-oriented helper in
xmldsig::whitespace, preserving invalid-byte rejection and error behavior.
Update the Base64 transform path and verify.rs callers to use that helper, then
remove the duplicate local implementation from transforms.rs.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: f6d7c4cf-ed65-46bf-a728-34b758bc8e13
📒 Files selected for processing (10)
src/c14n/serialize.rssrc/xmldsig/mod.rssrc/xmldsig/sign.rssrc/xmldsig/transforms.rssrc/xmldsig/types.rssrc/xmldsig/verify.rssrc/xmldsig/xpath.rstests/base64_transform_integration.rstests/c14n_golden.rstests/xpath_transform_integration.rs
Reproduce duplicate xml:base materialization when an omitted parent separates two included elements.
Stop C14N 1.1 xml:base materialization at the nearest included ancestor while preserving it as the URI resolution seed.
Reproduce malformed XPath elements when an expression namespace binding reuses the signature prefix for another URI.
Fail template validation when an XPath binding would move prefixed XMLDSig parameter elements into another namespace.
Reproduce the compatibility normalizer collapsing XPath word operators into function-like tokens.
Exclude XPath word operators from QName-to-function-call whitespace normalization.
Reproduce unbounded transform chains through both XML parsing and the public programmatic executor.
Reject references with more than 64 transforms at both XML parsing and public executor boundaries.
Route transform and signature verification byte streams through one XML-whitespace helper while retaining caller-specific alphabet validation.
|
@coderabbitai Fixed in deac05f: transform and SignatureValue verification now share a byte-oriented XML base64 normalizer with caller-specific alphabet validation; existing invalid-byte offsets and error mapping are preserved, with focused unit and integration coverage. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/c14n/escape.rs`:
- Around line 8-51: Update escape_text, escape_attr, and escape_cr to accumulate
contiguous unescaped byte ranges and emit each range with a single write_all
call, flushing the range before every escaped byte and after the loop. Preserve
the existing escaping mappings and output byte-for-byte behavior while avoiding
one write_all call per input byte.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 5910ff78-8053-4022-b661-c3644394c186
📒 Files selected for processing (10)
src/c14n/escape.rssrc/c14n/mod.rssrc/c14n/serialize.rssrc/xmldsig/builder.rssrc/xmldsig/parse.rssrc/xmldsig/sign.rssrc/xmldsig/transforms.rssrc/xmldsig/xpath.rstests/signature_builder.rstests/signing_digest.rs
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 449c6d2ad9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- Share one XPath parse budget across SignedInfo and Manifest references - Skip unauthenticated Manifest parsing after SignedInfo digest failure - Rebuild Manifest negative fixtures before computing their authenticating digest
- Meter every repeated XPath string operation and argument coercion - Batch contiguous C14N escape runs through bounded writers - Add deterministic work-meter and write-call regressions
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f32748a5fe
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- Distinguish core signature status from Manifest reference results - Document required inspection in the guide and public API rustdoc
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a0ccd5b392
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/xmldsig/verify.rs (1)
1093-1096: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winTerminal C14N/base64 check matches the current
Transformvariants.
The explicit allowlist coverage for no-transforms and a non-terminal binary transform before a final C14N/base64 can be added.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/xmldsig/verify.rs` around lines 1093 - 1096, Add explicit coverage around the terminal `produces_binary` check for references with no transforms and for a non-terminal binary transform followed by final C14N or Base64Decode. Verify both cases respect `allowed.contains(DEFAULT_IMPLICIT_C14N_URI)` while preserving the existing transform matching.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/xmldsig/xpath.rs`:
- Around line 221-289: Update xpath_string_scan_count to increment its scan
count for each =, <, and > encountered outside quoted literals, using the same
saturating behavior as comma counting; leave quoted operators ignored. Add a
regression test alongside xpath_filter_charges_each_repeated_string_scan
covering repeated comparisons such as /root/blob = 'missing' or /root/blob =
'absent' and verify each comparison contributes a string scan.
---
Outside diff comments:
In `@src/xmldsig/verify.rs`:
- Around line 1093-1096: Add explicit coverage around the terminal
`produces_binary` check for references with no transforms and for a non-terminal
binary transform followed by final C14N or Base64Decode. Verify both cases
respect `allowed.contains(DEFAULT_IMPLICIT_C14N_URI)` while preserving the
existing transform matching.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 76be4096-2b54-4770-aacc-de4cb94964f1
📒 Files selected for processing (6)
docs/xmldsig.mdsrc/c14n/escape.rssrc/xmldsig/parse.rssrc/xmldsig/transforms.rssrc/xmldsig/verify.rssrc/xmldsig/xpath.rs
- Defer Manifest processing until core signature validation succeeds - Meter node-set exclusions, XPath parent axes, and comparison string scans - Preserve Merlin interoperability and cover terminal transform allowlists
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b55e415d7a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- Recognize enveloped-signature as structure-preserving for ID-rooted Manifest and Object references - Cover both authenticated target forms through the complete verification pipeline
|
@coderabbitai Re: terminal C14N/base64 allowlist coverage - this finding is outdated. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '=== Candidate files ==='
fd -t f -e rs . src tests | sort | rg '/(verify|transforms|sign|xpath|.*integration)\.rs$' || true
printf '%s\n' '=== Policy implementation and named regression ==='
rg -n -C 14 --type rust \
'enforce_reference_policies_checks_only_terminal_binary_output|DEFAULT_IMPLICIT_C14N_URI|enforce_reference_policies|implicit.*C14N|terminal.*binary|terminal.*output|allowed_transforms' \
src tests || true
printf '%s\n' '=== Verify module outline ==='
ast-grep outline src/xmldsig/verify.rs --items all --type function,impl,enum,struct 2>/dev/null || trueLength of output: 50759
The regression does verify that a no-transform reference requires implicit C14N. However, both terminal-binary cases use an allowlist that already contains Please add a successful case for: vec![Transform::Base64Decode, Transform::Base64Decode]with You are interacting with an AI system. |
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/xmldsig.md`:
- Around line 33-39: Update the Manifest-processing documentation around
VerifyContext::process_manifests and VerifyResult::manifest_references to state
that disabling process_manifests(false) also leaves manifest_references empty.
Clarify that callers must distinguish this “not processed” state from an enabled
processing pass that produced no authenticated Manifest references.
In `@src/xmldsig/verify.rs`:
- Around line 1846-1884: The test
verify_context_processes_manifest_after_noop_enveloped_transform currently
checks only status and manifest reporting, not the transformed bytes. Enable
store_pre_digest(true) on VerifyContext and assert that
signed_info_references[0].pre_digest_data contains the ds:Manifest element and
its child ds:Reference, preserving coverage of the structural behavior described
by transform_preserves_manifest_structure.
- Around line 1037-1050: Update src/xmldsig/verify.rs:1037-1050 in
transform_preserves_manifest_structure to return false for Transform::Enveloped
and revise its comment to remove the incorrect no-op explanation. In
src/xmldsig/verify.rs:1846-1884, update
verify_context_processes_manifest_after_noop_enveloped_transform to enable
store_pre_digest(true) and assert that signed_info_references[0].pre_digest_data
contains the ds:Manifest element and its child ds:Reference.
- Around line 2365-2399: Extend
enforce_reference_policies_checks_only_terminal_binary_output to run the
Base64Decode-only chain with without_implicit_c14n, while retaining the existing
allowlist cases and assertions. Verify that the terminal binary output succeeds
without DEFAULT_IMPLICIT_C14N_URI being allowlisted.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 01f5a954-f524-4402-81fc-0530dfdd25a1
📒 Files selected for processing (5)
docs/xmldsig.mdsrc/xmldsig/transforms.rssrc/xmldsig/types.rssrc/xmldsig/verify.rssrc/xmldsig/xpath.rs
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cb889f31ce
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- Treat enveloped ID-rooted Manifest and Object references as structure-removing transforms - Assert the empty pre-digest contract for both target forms - Clarify disabled Manifest processing and isolate terminal Base64 allowlist coverage
- continue xml:base fixup past selected elements that do not emit a base - cover omitted descendants beneath a selected base-less ancestor
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 31f41c2d33
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/xmldsig/verify.rs`:
- Around line 1736-1764: Update
verify_context_skips_manifest_work_when_signature_value_is_invalid so its XML
mutation targets the Manifest DigestValue within ds:Object, matching the
positional approach used by
verify_context_reports_manifest_reference_parse_errors_explicitly, rather than
replacing SignatureValue text. Ensure the mutation actually produces malformed
nested Manifest content while preserving the invalid SignatureValue and the
test’s existing assertions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: bc922ded-b9d4-480f-829a-c18a56bfe7e9
📒 Files selected for processing (7)
docs/xmldsig.mdsrc/c14n/serialize.rssrc/c14n/xml_base.rssrc/xmldsig/transforms.rssrc/xmldsig/types.rssrc/xmldsig/verify.rssrc/xmldsig/xpath.rs
- charge numeric built-ins and arithmetic without misclassifying wildcard axes - make malformed Manifest fixtures structurally target nested digest values
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 932ec789b3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- Meter custom XPath string coercions and document comparison behavior - Share owned node-set materialization limits across signature processing - Cover resolver, projection, and binary adapter allocation paths
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 46a0ee4ce3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- Name specification and xmlsec legacy context nodes explicitly - Document the XMLDSig parent-element contract at parse time - Assert that specification here() is an element, not a text node
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 884b140b2b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- Charge each independent XPath path branch before SXD evaluation - Keep child, descendant, and parent-axis cost models distinct - Reject repeated child-axis unions through the shared work budget
|
@codex review |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Summary
<XPath>semantics forhere()plus explicit libxmlsec1<Transform>compatibility in signing and verificationid()values, XML 1.0-invalid XPath text or namespace bindings, reserved namespace bindings, namespaced ID mismatches, and parsedhere()locations reused with another document while preserving the implicit XPathxmlcontext and C14N 1.1xml:idnon-inheritancehere()provenance with lazy parse- and pointer-keyed execution-chain document identity caches, hashing each live XML document at most once per phase and skipping execution hashing entirely when no parsed provenance requires it<Signature>across filtered canonicalization and reparsing by tracking its emitted byte position instead of mutable sibling indices, while clearing stale identity when binary transforms replace the source documentxml:basecontext across selected element owners, version-specificxml:idinheritance, document-level separators, and all 28 Merlin canonical outputs byte-for-byteValidation
cargo check --all-targets --all-featurescargo check --no-default-features --features c14ncargo check --no-default-features --features xmldsigcargo check --examples --all-featurescargo clippy --all-targets --all-features -- -D warningscargo nextest run --all-features(785 passed)cargo test --doc --all-features(6 passed)cargo fmt --all -- --checkRUSTDOCFLAGS='-D warnings' cargo doc --all-features --no-depscargo package --all-features --allow-dirtycargo update --dry-run(5 Rust 1.92-compatible updates available; library lockfile is not tracked)Closes #100
Closes #101
Closes #102