Patched code sample

import signxml
import lxml.etree as ET
import base64
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric import padding

def fixed_verify(xml_data, hmac_key=None, expect_config=None, require_x509=True):
    """
    Verifies an XML signature, addressing CVE-2025-48994.

    Args:
        xml_data (bytes): The XML data containing the signature.
        hmac_key (bytes, optional): The HMAC key (if HMAC is used). Defaults to None.
        expect_config (dict, optional): Expected signature configuration. Defaults to None.
        require_x509 (bool): Require x509 cert validation

    Returns:
        lxml.etree._Element: The signed XML element if verification is successful, None otherwise.
    """
    try:
        root = ET.fromstring(xml_data)
    except ET.ParseError:
        print("Error: Invalid XML format.")
        return None

    verifier = signxml.XMLVerifier()

    if hmac_key is not None:
        # CVE-2025-48994 mitigation: Restrict algorithms to HMAC if hmac_key is provided
        if expect_config is None:
            expect_config = {}
        
        if 'algorithms' not in expect_config:
            expect_config['algorithms'] = {
                signxml.methods.HMAC: [
                    signxml.transforms.Algorithm.SHA1,
                    signxml.transforms.Algorithm.SHA224,
                    signxml.transforms.Algorithm.SHA256,
                    signxml.transforms.Algorithm.SHA384,
                    signxml.transforms.Algorithm.SHA512,
                    signxml.transforms.Algorithm.RIPEMD160, #added for completeness
                ]
            }
        # Ensure only HMAC algorithms are allowed if an HMAC key is provided. Prevents confusion attacks.
        else:
            hmac_algorithms = [
                signxml.transforms.Algorithm.SHA1,
                signxml.transforms.Algorithm.SHA224,
                signxml.transforms.Algorithm.SHA256,
                signxml.transforms.Algorithm.SHA384,
                signxml.transforms.Algorithm.SHA512,
                signxml.transforms.Algorithm.RIPEMD160,
            ]
            allowed_algorithms = expect_config['algorithms'].get(signxml.methods.HMAC, [])
            for algo in allowed_algorithms:
                if algo not in hmac_algorithms:
                    print("Error: HMAC algorithm specified but is not valid")
                    return None

    try:
        signed_element = verifier.verify(root, require_x509=require_x509, hmac_key=hmac_key, expect_config=expect_config)
        return signed_element
    except signxml.exceptions.InvalidSignature:
        print("Error: XML signature is invalid.")
        return None
    except Exception as e:
        print(f"Error during verification: {e}")
        return None

if __name__ == '__main__':
    # Example usage with HMAC key (demonstrating the fix)

    # Create a sample XML document
    xml_data = b"""<root><data>This is the data to be signed.</data></root>"""

    # Generate an HMAC key
    hmac_key = b"shared-secret-key"

    #Sign the document with HMAC 
    signer = signxml.XMLSigner(method=signxml.methods.HMAC, digest_algorithm='sha256', hmac_key=hmac_key)
    signed_xml = signer.sign(xml_data)

    # Verify the signature
    verified_element = fixed_verify(signed_xml, hmac_key=hmac_key, require_x509=False)

    if verified_element is not None:
        print("XML signature is valid.")
        print("Signed XML element:", ET.tostring(verified_element))
    else:
        print("XML signature is invalid or verification failed.")

    # Example of an attack attempt (using RSA key instead of HMAC), this will now fail.
    private_key = rsa.generate_private_key(
        public_exponent=65537,
        key_size=2048,
        backend=default_backend()
    )
    public_key = private_key.public_key()
    public_key_pem = public_key.public_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PublicFormat.SubjectPublicKeyInfo
    )
    private_key_pem = private_key.private_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PrivateFormat.PKCS8,
        encryption_algorithm=serialization.NoEncryption()
    )
    signer = signxml.XMLSigner(method=signxml.methods.RSA_SHA256, key=private_key_pem) # Attacker uses RSA.
    attack_xml = signer.sign(xml_data)

    # Verification attempt - should FAIL due to algorithm confusion.
    attack_verified_element = fixed_verify(attack_xml, hmac_key=hmac_key, require_x509=False)

    if attack_verified_element is not None:
        print("Attack: XML signature is valid (this should not happen!).")
    else:
        print("Attack: XML signature verification failed as expected.") # This should happen.