sign-spec.tmpl

如何实现安全的xml机制

<?xml version="1.0"?>
<Document>
  <ToBeSigned>
    <!-- comment -->
    <Data />
    <NotToBeSigned>
      <ReallyToBeSigned>
        <!-- comment -->
        <Data />
      </ReallyToBeSigned>
    </NotToBeSigned>
  </ToBeSigned>
  <ToBeSigned>
    <Data />
    <NotToBeSigned>
      <Data />
    </NotToBeSigned>
  </ToBeSigned>
  <dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:dsig-xpath="http://www.w3.org/2002/06/xmldsig-filter2">
    <dsig:SignedInfo>
      <dsig:CanonicalizationMethod Algorithm="" />
      <dsig:SignatureMethod Algorithm="" />
      <dsig:Reference URI="">
        <dsig:Transforms>
          <dsig:Transform Algorithm="http://www.w3.org/2002/06/xmldsig-filter2">
            <dsig-xpath:XPath Filter="intersect"> //ToBeSigned </dsig-xpath:XPath>
            <dsig-xpath:XPath Filter="subtract"> //NotToBeSigned </dsig-xpath:XPath>
            <dsig-xpath:XPath Filter="union"> //ReallyToBeSigned </dsig-xpath:XPath>
          </dsig:Transform>
        </dsig:Transforms>
        <dsig:DigestMethod Algorithm="" />
        <dsig:DigestValue />
      </dsig:Reference>
      <dsig:Reference URI="#signature-value">
        <dsig:Transforms>
          <dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
          <dsig:Transform Algorithm="http://www.w3.org/2002/06/xmldsig-filter2">
            <dsig-xpath:XPath Filter="union"> /</dsig-xpath:XPath>
          </dsig:Transform>
        </dsig:Transforms>
        <dsig:DigestMethod Algorithm="" />
        <dsig:DigestValue />
      </dsig:Reference>
    </dsig:SignedInfo>
    <dsig:SignatureValue Id="signature-value" />
  </dsig:Signature>
</Document>