"enveloped" canonicalization removes nested Signatures

[rkaw92]

When using this library with SAML, we've encountered an issue where signing a message that already contains a nested Signature will strip it before signing, yielding an invalid DigestValue, and thus an incorrect signature:

1. Take a SAML Response XML document with node hierarchy: samlp:Response > samlp:Assertion
2. Generate a signature for the Assertion node (using a Reference that points to it by ID)
3. Place the resulting Signature element inside the Assertion
4. Generate a signature for the entire Response, which should compute the hash from the entire canonicalized contents

Apparently, step 4. removes the nested Signature node before signing, which is incorrect - the node should only be replaced if it's a direct descendant of our node being signed.

This is caused by an overly-general XPath being used to find pre-existing Signatures. From the source of enveloped_signature.ts:

const signature = Select(this.innerXml, ".//*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']")[0];
        if (signature) {
            signature.parentNode!.removeChild(signature);
        }

Changing this to only match direct descendants (single slash instead of double) fixes the issue and prevents deeply-nested existing Signatures from being removed. The change is essential to enable proper SAML 2.0 support, because it often uses nested signatures in a scheme exactly like the one shown above.

[microshine]

Please check [email protected]