ruby-saml-mod 0.1.28 → 0.1.29

data/lib/xml_sec.rb

@@ -84,7 +84,7 @@ module XMLSecurity
 
   class XmlSecPtrList < FFI::Struct
     layout \
-      :id,                          :string,
+      :id,                          :pointer,
       :data,                        :pointer,        # xmlSecPtr*
       :use,                         :uint,
       :max,                         :uint,
@@ -120,6 +120,19 @@ module XMLSecurity
       :reserved1,                   :pointer         # void *
   end
 
+  class XmlSecTransformUriType
+    None         = 0x0000
+    Empty        = 0x0001
+    SameDocument = 0x0002
+    Local        = 0x0004
+    Remote       = 0x0008
+    Any          = 0xFFFF
+
+    def self.conservative
+      (Empty | SameDocument)
+    end
+  end
+
   class XmlSecKeyInfoCtx < FFI::Struct
     layout \
       :userDate,                    :pointer,
@@ -152,7 +165,7 @@ module XMLSecurity
       :keyInfoWriteCtx,             XmlSecKeyInfoCtx.by_value,
       :transformCtx,                XmlSecTransformCtx.by_value,
       :enabledReferenceUris,        :uint,        # xmlSecTransformUriType
-      :enabledReferenceTransforms,  :pointer,     # xmlSecPtrListPtr
+      :enabledReferenceTransforms,  XmlSecPtrList.by_ref,     # xmlSecPtrListPtr
       :referencePreExecuteCallback, :pointer,     # xmlSecTransformCtxPreExecuteCallback
       :defSignMethodId,             :string,      # xmlSecTransformId
       :defC14NMethodId,             :string,      # xmlSecTransformId
@@ -223,8 +236,12 @@ module XMLSecurity
 
   attach_function :xmlSecDSigCtxSign, [ :pointer, :pointer ], :int
 
-
-
+  attach_function :xmlSecDSigCtxEnableReferenceTransform, [ :pointer, :pointer ], :int
+  attach_function :xmlSecPtrListAdd, [ :pointer, :pointer ], :int
+  attach_function :xmlSecPtrListGetItem, [ :pointer, :uint ], :pointer
+  attach_function :xmlSecPtrListGetSize, [ :pointer ], :uint
+  attach_function :xmlSecTransformIdsGet, [], :pointer
+  attach_function :xmlSecTransformXsltGetKlass, [], :pointer
 
   # libxml functions
   attach_function :xmlInitParser, [], :void
@@ -269,6 +286,23 @@ module XMLSecurity
     xmlSecErrorsDefaultCallbackEnableOutput(true)
   end
 
+  def self.disable_xslt_transforms!(dsig_context)
+    all_transforms = XMLSecurity.xmlSecTransformIdsGet
+
+    (0...XMLSecurity.xmlSecPtrListGetSize(all_transforms)).each do |pos|
+      transform = XMLSecurity.xmlSecPtrListGetItem(all_transforms, pos)
+      unless transform == XMLSecurity.xmlSecTransformXsltGetKlass
+        XMLSecurity.xmlSecPtrListAdd(dsig_context[:transformCtx][:enabledTransforms], transform)
+        XMLSecurity.xmlSecDSigCtxEnableReferenceTransform(dsig_context, transform)
+      end
+    end
+  end
+
+  def self.disable_remote_references!(dsig_context)
+    dsig_context[:transformCtx][:enabledUris] = XmlSecTransformUriType.conservative
+    dsig_context[:enabledReferenceUris] = XmlSecTransformUriType.conservative
+  end
+
   module SignedDocument
     attr_reader :validation_error
 
@@ -366,6 +400,9 @@ module XMLSecurity
         ctx = XMLSecurity.xmlSecDSigCtxCreate(kmgr)
         raise "failed creating digital signature context" if ctx.null?
 
+        XMLSecurity.disable_xslt_transforms!(ctx)
+        XMLSecurity.disable_remote_references!(ctx)
+
         # verify!
         raise "failed verifying dsig" if XMLSecurity.xmlSecDSigCtxVerify(ctx, node) < 0
         result = ctx[:status] == :xmlSecDSigStatusSucceeded

data/ruby-saml-mod.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name = %q{ruby-saml-mod}
-  s.version = "0.1.28"
+  s.version = "0.1.29"
 
   s.authors = ["OneLogin LLC", "Bracken", "Zach", "Cody", "Jeremy", "Paul"]
   s.date = %q{2014-05-05}

metadata

@@ -1,7 +1,8 @@
 --- !ruby/object:Gem::Specification
 name: ruby-saml-mod
 version: !ruby/object:Gem::Version
-  version: 0.1.28
+  version: 0.1.29
+  prerelease: 
 platform: ruby
 authors:
 - OneLogin LLC
@@ -18,33 +19,37 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: libxml-ruby
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - ">="
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: 2.3.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - ">="
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: 2.3.0
 - !ruby/object:Gem::Dependency
   name: ffi
   requirement: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - ">="
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - ">="
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
-description: 'This is an early fork from https://github.com/onelogin/ruby-saml - I
-  plan to "rebase" these changes ontop of their current version eventually. '
+description: ! 'This is an early fork from https://github.com/onelogin/ruby-saml -
+  I plan to "rebase" these changes ontop of their current version eventually. '
 email: 
 executables: []
 extensions: []
@@ -67,25 +72,26 @@ files:
 - ruby-saml-mod.gemspec
 homepage: http://github.com/bracken/ruby-saml
 licenses: []
-metadata: {}
 post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
   requirements:
-  - - ">="
+  - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
   requirements:
-  - - ">="
+  - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.2
+rubygems_version: 1.8.23.2
 signing_key: 
-specification_version: 4
+specification_version: 3
 summary: Ruby library for SAML service providers
 test_files: []

checksums.yaml

@@ -1,7 +0,0 @@
----
-SHA1:
-  metadata.gz: 364210a5dc8d2c29558b9b0a19c258f64cdb1c9b
-  data.tar.gz: 5c389976863d3d599ea7fdcf1c91932f0418b169
-SHA512:
-  metadata.gz: b025fe482372d414d6fc263f5bbc2623e7070daa3d5fe8e2f6004b9e51494260f0746339d71791e7911c10be75b5f692069f2a98dc3d8e99985bf99c39cdab63
-  data.tar.gz: 5826d046b3eccb253f38611afde71d6e602778b1e998d3baf3c7ba1629505821b60bfc4687f8f9e5e63164a305b429adfd39b6ccbd2358450636161eb6a73cdd