ruby-saml-mod 0.3.2 → 0.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: cdc20d25c398592f85e78ed66f873fccc72db0a1
-  data.tar.gz: 3a60912787e674be7705ba270e457b0c5f4c9d44
+  metadata.gz: d02bac8c935c4d507958fe156c40594db905fe48
+  data.tar.gz: 46e0b658bb92f769a0a4f10df098ebd912be9ec8
 SHA512:
-  metadata.gz: 05e2d73084ce8940e8e34fde85e3c34ab47c1622ab3854f477d69beee6180d9dd8094b3dc1dc051f49ebaf45ca9b1f9051de893ebe09ba1d3782e0ffaf7202ad
-  data.tar.gz: 853b7363a58a36b997bd04b6bbb1a3927f626463f13360a1dc456964dc5aecc97c43e93451c332cc68eb84a853dc26f978d8d27714d8727901a19cdc1a1f7525
+  metadata.gz: afef8cf1ea14e68263dded8a98ef44bb1bca63c94322386e23ffe67eb60d64bd07f98dae75d15d72b6b3a1fd1fea144da84fc6ea75ee5ce719e7a2abbeba19f0
+  data.tar.gz: e350bcbfba23e2ca8facac0dcba29a3b0373865461007c2a316b07a0bd01b584b6fa0e1fa1ce49ca6462e55198a38e1f3cab3c7d441392b2e0befd56be2470be

data/lib/onelogin/saml.rb

@@ -33,6 +33,14 @@ module Onelogin
     "urn:oid:1.3.6.1.4.1.5923.1.2.1.5" => "eduOrgSuperiorURI",
     "urn:oid:1.3.6.1.4.1.5923.1.2.1.6" => "eduOrgWhitePagesURI",
   }
+
+  module Saml
+    class << self
+      def config
+        @config ||= { max_message_size: 1024 * 1024 }
+      end
+    end
+  end
 end
 
 require 'onelogin/saml/base_assertion'

data/lib/onelogin/saml/base_assertion.rb

@@ -58,13 +58,23 @@ module Onelogin::Saml
     end
 
     def self.parse(raw_assertion, settings = nil)
+      raise "SAML assertion too large" if raw_assertion.bytesize > Onelogin::Saml.config[:max_message_size]
       assertion = new
       assertion.base64_assertion = raw_assertion
 
       decoded_xml = Base64.decode64(raw_assertion)
-      zlib = Zlib::Inflate.new(-Zlib::MAX_WBITS)
+      zlib = Zlib::Inflate.new
 
-      assertion.xml = zlib.inflate(decoded_xml)
+      xml = ''
+      # do it in 1K slices, so we can protect against bombs
+      (0..decoded_xml.bytesize / 1024).each do |i|
+        xml.concat(zlib.inflate(decoded_xml.byteslice(i * 1024, 1024)))
+        raise "SAML assertion too large" if xml.bytesize > Onelogin::Saml.config[:max_message_size]
+      end
+      xml.concat(zlib.finish)
+      raise "SAML assertion too large" if xml.bytesize > Onelogin::Saml.config[:max_message_size]
+
+      assertion.xml = xml
 
       assertion.process(settings) if settings
       assertion

data/spec/logout_response_spec.rb

@@ -24,6 +24,12 @@ describe Onelogin::Saml::LogoutResponse do
     Onelogin::Saml::LogoutResponse::generate(in_response_to, settings).document
   end
 
+  it "protects against deflate bombs" do
+    # this decompresses to 2MB of NULLs
+    bomb = "eJztwTEBAAAAwqD1T20MH6AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvgYB4AAB"
+    expect { Onelogin::Saml::LogoutResponse.parse(bomb) }.to raise_error("SAML assertion too large")
+  end
+
   it "includes destination in the saml:LogoutRequest attributes" do
     value = xml.at_xpath('/samlp:LogoutResponse', Onelogin::NAMESPACES)['Destination']
     expect(value).to eq "http://idp.example.com/saml2?existing=param&existing=param"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby-saml-mod
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.3.3
 platform: ruby
 authors:
 - OneLogin LLC
@@ -14,7 +14,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-02-06 00:00:00.000000000 Z
+date: 2017-03-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri
@@ -138,7 +138,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.10
+rubygems_version: 2.6.11
 signing_key: 
 specification_version: 4
 summary: Ruby library for SAML service providers