Reset per-signature state in loadSignature

signatureAlgorithm, canonicalizationAlgorithm, signatureValue, and
keyInfo were only assigned when the corresponding node existed in the
signature being loaded, so a reused instance silently inherited values
from a previously loaded signature when the new one omitted them. A
document whose <SignatureValue> was emptied would still verify against
the value left over from the previous verification.

Reset all four fields at the top of loadSignature and add a regression
test covering the stale-SignatureValue case on a reused verifier.

Author: shunkica

src/signed-xml.ts

@@ -702,6 +702,16 @@ export class SignedXml {
    * @param signatureNode The XML node or string representing the signature.
    */
   loadSignature(signatureNode: Node | string): void {
+    // Reset all per-signature state before parsing. The fields below are only
+    // assigned when the corresponding node exists in the new signature, so
+    // without this reset a reused instance would silently inherit values
+    // (algorithm, signature value, key material) from a previously loaded
+    // signature when the new one omits them.
+    this.signatureAlgorithm = undefined;
+    this.canonicalizationAlgorithm = undefined;
+    this.signatureValue = "";
+    this.keyInfo = null;
+
     const signatureNodeParsed =
       typeof signatureNode === "string" ? utils.parseXml(signatureNode) : signatureNode;
     this.signatureNode = signatureNodeParsed;

test/xmldsig-verifier.spec.ts

@@ -405,6 +405,28 @@ describe("XmlDSigVerifier", function () {
       expectValidResult(verifier.verifySignature(signedXml), 1);
     });
 
+    it("does not reuse the previous document's SignatureValue when the next document omits it", function () {
+      const signedXml = createChainSignedXml(xml);
+      // Same document, but with an emptied <SignatureValue>. A verifier that
+      // leaks state would fall back to the value loaded on the previous call
+      // and wrongly report success.
+      const stripped = signedXml.replace(
+        /<SignatureValue>[^<]*<\/SignatureValue>/,
+        "<SignatureValue></SignatureValue>",
+      );
+      expect(stripped).to.not.equal(signedXml);
+
+      const verifier = new XmlDSigVerifier({
+        keySelector: {
+          getCertFromKeyInfo: () => chainPublicCert,
+        },
+        security: { truststore: [rootCert] },
+      });
+
+      expectValidResult(verifier.verifySignature(signedXml));
+      expectInvalidResult(verifier.verifySignature(stripped), "invalid signature");
+    });
+
     it("verifies using a certificate actually extracted from the document's KeyInfo", function () {
       // Unlike the constant-callback tests above, this exercises the real
       // extraction path: the cert comes out of <KeyInfo>, not the test closure.