fix: read OAEPparams and MGF through the DOM helpers

These three lookups were added on top of the XPath implementation and are the
last remaining callers. Route them through dom.child so the OAEP additions use
the same scoped resolution as the rest of decryptKeyInfo.

test/dom-select.js wraps its fixtures with MGF1-SHA1 here, since
rsa-oaep-mgf1p fixes the mask generation function regardless of DigestMethod
and crypto.publicEncrypt cannot set the two digests independently.

121 passing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: elbuo8

lib/xmlenc.js

@@ -341,21 +341,21 @@ function decryptKeyInfo(doc, options) {
   }
 
   // Read the OAEP label from the optional OAEPparams element (XML-Enc 1.1 5.5.2).
-  const oaepParams = xpath.select("./*[local-name(.)='OAEPparams']", keyEncryptionMethod)[0];
+  const oaepParams = dom.child(keyEncryptionMethod, 'OAEPparams');
   const oaepLabel = oaepParams ? Buffer.from(oaepParams.textContent, 'base64') : Buffer.alloc(0);
 
   switch (keyEncryptionAlgorithm) {
     case 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p':
       // The identifier fixes MGF1 to SHA-1 (XML-Enc 1.1 5.5.2); DigestMethod
       // selects only the OAEP message digest. An xenc11:MGF child is a MUST NOT.
-      if (xpath.select("./*[local-name(.)='MGF']", keyEncryptionMethod)[0]) {
+      if (dom.child(keyEncryptionMethod, 'MGF')) {
         throw new Error('MGF element must not be present with ' + keyEncryptionAlgorithm);
       }
       return decryptKeyInfoWithScheme(encryptedKey, options, crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash, 'sha1', oaepLabel);
 
     case 'http://www.w3.org/2009/xmlenc11#rsa-oaep': {
       // MGF1 comes from the optional xenc11:MGF child; default MGF1-SHA1.
-      const mgfElement = xpath.select("./*[local-name(.)='MGF']", keyEncryptionMethod)[0];
+      const mgfElement = dom.child(keyEncryptionMethod, 'MGF');
       let mgf1Hash = 'sha1';
       if (mgfElement) {
         const mgfAlgorithm = mgfElement.getAttribute('Algorithm');

test/dom-select.js

@@ -1,9 +1,9 @@
 var assert = require('assert');
-var crypto = require('crypto');
 var fs = require('fs');
 var xmldom = require('@xmldom/xmldom');
 var xpath = require('xpath');
 var dom = require('../lib/dom-select');
+var oaep = require('../lib/oaep');
 var xmlenc = require('../lib/xmlenc');
 
 var XENC = 'http://www.w3.org/2001/04/xmlenc#';
@@ -187,13 +187,11 @@ describe('decryptKeyInfo element resolution', function () {
   var pub = fs.readFileSync(__dirname + '/test-auth0_rsa.pub');
   var key = fs.readFileSync(__dirname + '/test-auth0.key');
 
-  // master's decrypt path uses crypto directly; oaepHash follows DigestMethod.
+  // rsa-oaep-mgf1p fixes MGF1 to SHA-1, so these fixtures must be wrapped that
+  // way whatever the DigestMethod says. crypto.publicEncrypt cannot express the
+  // two digests independently.
   function wrap(symmetricKey, oaepHash) {
-    return crypto.publicEncrypt({
-      key: pub,
-      padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
-      oaepHash: oaepHash
-    }, symmetricKey);
+    return oaep.publicEncryptOaep(pub, symmetricKey, { oaepHash: oaepHash, mgf1Hash: 'sha1' });
   }
 
   it('pairs DigestMethod with the EncryptedKey actually in use', function () {