ruby-saml 0.8.12

data/test/utils_test.rb

@@ -0,0 +1,41 @@
+require File.expand_path(File.join(File.dirname(__FILE__), "test_helper"))
+
+class UtilsTest < Minitest::Test
+  describe "Utils" do
+    describe 'element_text' do
+      it 'returns the element text' do
+        element = REXML::Document.new('<element>element text</element>').elements.first
+        assert_equal 'element text', OneLogin::RubySaml::Utils.element_text(element)
+      end
+
+      it 'returns all segments of the element text' do
+        element = REXML::Document.new('<element>element <!-- comment -->text</element>').elements.first
+        assert_equal 'element text', OneLogin::RubySaml::Utils.element_text(element)
+      end
+
+      it 'returns normalized element text' do
+        element = REXML::Document.new('<element>element &amp; text</element>').elements.first
+        assert_equal 'element & text', OneLogin::RubySaml::Utils.element_text(element)
+      end
+
+      it 'returns the CDATA element text' do
+        element = REXML::Document.new('<element><![CDATA[element & text]]></element>').elements.first
+        assert_equal 'element & text', OneLogin::RubySaml::Utils.element_text(element)
+      end
+
+      it 'returns the element text with newlines and additional whitespace' do
+        element = REXML::Document.new("<element>  element \n text  </element>").elements.first
+        assert_equal "  element \n text  ", OneLogin::RubySaml::Utils.element_text(element)
+      end
+
+      it 'returns nil when element is nil' do
+        assert_nil OneLogin::RubySaml::Utils.element_text(nil)
+      end
+
+      it 'returns empty string when element has no text' do
+        element = REXML::Document.new('<element></element>').elements.first
+        assert_equal '', OneLogin::RubySaml::Utils.element_text(element)
+      end
+    end
+  end
+end

data/test/xml_security_test.rb

@@ -0,0 +1,158 @@
+require File.expand_path(File.join(File.dirname(__FILE__), "test_helper"))
+
+class XmlSecurityTest < Minitest::Test
+  include XMLSecurity
+
+  describe "XmlSecurity" do
+    before do
+      @document = XMLSecurity::SignedDocument.new(Base64.decode64(response_document))
+      @base64cert = @document.elements["//ds:X509Certificate"].text
+    end
+
+    it "should run validate without throwing NS related exceptions" do
+      assert !@document.validate_signature(@base64cert, true)
+    end
+
+    it "should run validate with throwing NS related exceptions" do
+      assert_raises(OneLogin::RubySaml::ValidationError) do
+        @document.validate_signature(@base64cert, false)
+      end
+    end
+
+    it "not raise an error when softly validating the document multiple times" do
+      2.times { @document.validate_signature(@base64cert, true) }
+    end
+
+    it "should raise Fingerprint mismatch" do
+      exception = assert_raises(OneLogin::RubySaml::ValidationError) do
+        @document.validate_document("no:fi:ng:er:pr:in:t", false)
+      end
+      assert_equal("Fingerprint mismatch", exception.message)
+    end
+
+    it "should raise Digest mismatch" do
+      exception = assert_raises(OneLogin::RubySaml::ValidationError) do
+        @document.validate_signature(@base64cert, false)
+      end
+      assert_equal("Digest mismatch", exception.message)
+    end
+
+    it "should raise Key validation error" do
+      response = Base64.decode64(response_document)
+      response.sub!("<ds:DigestValue>pJQ7MS/ek4KRRWGmv/H43ReHYMs=</ds:DigestValue>",
+                    "<ds:DigestValue>b9xsAXLsynugg3Wc1CI3kpWku+0=</ds:DigestValue>")
+      document = XMLSecurity::SignedDocument.new(response)
+      base64cert = document.elements["//ds:X509Certificate"].text
+      exception = assert_raises(OneLogin::RubySaml::ValidationError) do
+        document.validate_signature(base64cert, false)
+      end
+      assert_equal("Key validation error", exception.message)
+    end
+
+    it "raise validation error when the X509Certificate is missing" do
+      response = Base64.decode64(response_document)
+      response.sub!(/<ds:X509Certificate>.*<\/ds:X509Certificate>/, "")
+      document = XMLSecurity::SignedDocument.new(response)
+      exception = assert_raises(OneLogin::RubySaml::ValidationError) do
+        document.validate_document("a fingerprint", false) # The fingerprint isn't relevant to this test
+      end
+      assert_equal("Certificate element missing in response (ds:X509Certificate)", exception.message)
+    end
+  end
+
+  describe "Algorithms" do
+    it "validate using SHA1" do
+      @document = XMLSecurity::SignedDocument.new(fixture(:adfs_response_sha1, false))
+      assert @document.validate_document("F1:3C:6B:80:90:5A:03:0E:6C:91:3E:5D:15:FA:DD:B0:16:45:48:72")
+    end
+
+    it "validate using SHA256" do
+      @document = XMLSecurity::SignedDocument.new(fixture(:adfs_response_sha256, false))
+      assert @document.validate_document("28:74:9B:E8:1F:E8:10:9C:A8:7C:A9:C3:E3:C5:01:6C:92:1C:B4:BA")
+    end
+
+    it "validate using SHA384" do
+      @document = XMLSecurity::SignedDocument.new(fixture(:adfs_response_sha384, false))
+      assert @document.validate_document("F1:3C:6B:80:90:5A:03:0E:6C:91:3E:5D:15:FA:DD:B0:16:45:48:72")
+    end
+
+    it "validate using SHA512" do
+      @document = XMLSecurity::SignedDocument.new(fixture(:adfs_response_sha512, false))
+      assert @document.validate_document("F1:3C:6B:80:90:5A:03:0E:6C:91:3E:5D:15:FA:DD:B0:16:45:48:72")
+    end
+  end
+
+  describe "XmlSecurity::SignedDocument" do
+
+    describe "#extract_inclusive_namespaces" do
+      it "support explicit namespace resolution for exclusive canonicalization" do
+        response = fixture(:open_saml_response, false)
+        document = XMLSecurity::SignedDocument.new(response)
+        inclusive_namespaces = document.send(:extract_inclusive_namespaces)
+
+        assert_equal %w[ xs ], inclusive_namespaces
+      end
+
+      it "support implicit namespace resolution for exclusive canonicalization" do
+        response = fixture(:no_signature_ns, false)
+        document = XMLSecurity::SignedDocument.new(response)
+        inclusive_namespaces = document.send(:extract_inclusive_namespaces)
+
+        assert_equal %w[ #default saml ds xs xsi ], inclusive_namespaces
+      end
+
+      it 'support inclusive canonicalization' do
+        skip('test not yet implemented')
+
+        response = OneLogin::RubySaml::Response.new(fixture("tdnf_response.xml"))
+        response.stubs(:conditions).returns(nil)
+        assert !response.is_valid?
+        settings = OneLogin::RubySaml::Settings.new
+        assert !response.is_valid?
+        response.settings = settings
+        assert !response.is_valid?
+        settings.idp_cert_fingerprint = "e6 38 9a 20 b7 4f 13 db 6a bc b1 42 6a e7 52 1d d6 56 d4 1b".upcase.gsub(" ", ":")
+        assert response.validate!
+      end
+
+      it "return an empty list when inclusive namespace element is missing" do
+        response = fixture(:no_signature_ns, false)
+        response.slice! %r{<InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="#default saml ds xs xsi"/>}
+
+        document = XMLSecurity::SignedDocument.new(response)
+        inclusive_namespaces = document.send(:extract_inclusive_namespaces)
+
+        assert inclusive_namespaces.empty?
+      end
+    end
+
+    describe "StarfieldTMS" do
+      before do
+        @response = OneLogin::RubySaml::Response.new(fixture(:starfield_response))
+        @response.settings = OneLogin::RubySaml::Settings.new(
+                                                          :idp_cert_fingerprint => "8D:BA:53:8E:A3:B6:F9:F1:69:6C:BB:D9:D8:BD:41:B3:AC:4F:9D:4D"
+                                                          )
+      end
+
+      it "be able to validate a good response" do
+        Timecop.freeze Time.parse('2012-11-28 17:55:00 UTC') do
+          assert @response.validate!
+        end
+      end
+
+      it "fail before response is valid" do
+        Timecop.freeze Time.parse('2012-11-20 17:55:00 UTC') do
+          assert ! @response.is_valid?
+        end
+      end
+
+      it "fail after response expires" do
+        Timecop.freeze Time.parse('2012-11-30 17:55:00 UTC') do
+          assert ! @response.is_valid?
+        end
+      end
+    end
+
+  end
+
+end

metadata

@@ -0,0 +1,178 @@
+--- !ruby/object:Gem::Specification 
+name: ruby-saml
+version: !ruby/object:Gem::Version 
+  version: 0.8.12
+platform: ruby
+authors: 
+- OneLogin LLC
+autorequire: 
+bindir: bin
+cert_chain: []
+
+date: 2020-05-08 00:00:00 Z
+dependencies: 
+- !ruby/object:Gem::Dependency 
+  name: uuid
+  prerelease: false
+  requirement: &id001 !ruby/object:Gem::Requirement 
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        version: "2.3"
+  type: :runtime
+  version_requirements: *id001
+- !ruby/object:Gem::Dependency 
+  name: nokogiri
+  prerelease: false
+  requirement: &id002 !ruby/object:Gem::Requirement 
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        version: 1.5.0
+  type: :runtime
+  version_requirements: *id002
+description: SAML toolkit for Ruby on Rails
+email: support@onelogin.com
+executables: []
+
+extensions: []
+
+extra_rdoc_files: 
+- LICENSE
+- README.md
+files: 
+- .document
+- .gitignore
+- .travis.yml
+- Gemfile
+- LICENSE
+- README.md
+- Rakefile
+- changelog.md
+- lib/onelogin/ruby-saml/attributes.rb
+- lib/onelogin/ruby-saml/authrequest.rb
+- lib/onelogin/ruby-saml/logging.rb
+- lib/onelogin/ruby-saml/logoutrequest.rb
+- lib/onelogin/ruby-saml/logoutresponse.rb
+- lib/onelogin/ruby-saml/metadata.rb
+- lib/onelogin/ruby-saml/response.rb
+- lib/onelogin/ruby-saml/setting_error.rb
+- lib/onelogin/ruby-saml/settings.rb
+- lib/onelogin/ruby-saml/slo_logoutresponse.rb
+- lib/onelogin/ruby-saml/utils.rb
+- lib/onelogin/ruby-saml/validation_error.rb
+- lib/onelogin/ruby-saml/version.rb
+- lib/ruby-saml.rb
+- lib/schemas/saml20assertion_schema.xsd
+- lib/schemas/saml20protocol_schema.xsd
+- lib/schemas/xenc_schema.xsd
+- lib/schemas/xmldsig_schema.xsd
+- lib/xml_security.rb
+- ruby-saml.gemspec
+- test/certificates/certificate1
+- test/certificates/r1_certificate2_base64
+- test/certificates/ruby-saml.crt
+- test/certificates/ruby-saml.key
+- test/logoutrequest_test.rb
+- test/logoutresponse_test.rb
+- test/request_test.rb
+- test/response_test.rb
+- test/responses/adfs_response_sha1.xml
+- test/responses/adfs_response_sha256.xml
+- test/responses/adfs_response_sha384.xml
+- test/responses/adfs_response_sha512.xml
+- test/responses/encrypted_new_attack.xml.base64
+- test/responses/logoutresponse_fixtures.rb
+- test/responses/no_signature_ns.xml
+- test/responses/open_saml_response.xml
+- test/responses/r1_response6.xml.base64
+- test/responses/response1.xml.base64
+- test/responses/response2.xml.base64
+- test/responses/response3.xml.base64
+- test/responses/response4.xml.base64
+- test/responses/response5.xml.base64
+- test/responses/response_eval.xml
+- test/responses/response_node_text_attack.xml.base64
+- test/responses/response_with_ampersands.xml
+- test/responses/response_with_ampersands.xml.base64
+- test/responses/response_with_concealed_signed_assertion.xml
+- test/responses/response_with_doubled_signed_assertion.xml
+- test/responses/response_with_multiple_attribute_statements.xml
+- test/responses/response_with_multiple_attribute_values.xml
+- test/responses/response_wrapped.xml.base64
+- test/responses/simple_saml_php.xml
+- test/responses/starfield_response.xml.base64
+- test/responses/valid_response.xml.base64
+- test/responses/wrapped_response_2.xml.base64
+- test/settings_test.rb
+- test/slo_logoutresponse_test.rb
+- test/test_helper.rb
+- test/utils_test.rb
+- test/xml_security_test.rb
+homepage: http://github.com/onelogin/ruby-saml
+licenses: []
+
+metadata: {}
+
+post_install_message: 
+rdoc_options: 
+- --charset=UTF-8
+require_paths: 
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement 
+  requirements: 
+  - &id003 
+    - ">="
+    - !ruby/object:Gem::Version 
+      version: "0"
+required_rubygems_version: !ruby/object:Gem::Requirement 
+  requirements: 
+  - *id003
+requirements: []
+
+rubyforge_project: http://www.rubygems.org/gems/ruby-saml
+rubygems_version: 2.7.7
+signing_key: 
+specification_version: 4
+summary: SAML Ruby Tookit
+test_files: 
+- test/certificates/certificate1
+- test/certificates/r1_certificate2_base64
+- test/certificates/ruby-saml.crt
+- test/certificates/ruby-saml.key
+- test/logoutrequest_test.rb
+- test/logoutresponse_test.rb
+- test/request_test.rb
+- test/response_test.rb
+- test/responses/adfs_response_sha1.xml
+- test/responses/adfs_response_sha256.xml
+- test/responses/adfs_response_sha384.xml
+- test/responses/adfs_response_sha512.xml
+- test/responses/encrypted_new_attack.xml.base64
+- test/responses/logoutresponse_fixtures.rb
+- test/responses/no_signature_ns.xml
+- test/responses/open_saml_response.xml
+- test/responses/r1_response6.xml.base64
+- test/responses/response1.xml.base64
+- test/responses/response2.xml.base64
+- test/responses/response3.xml.base64
+- test/responses/response4.xml.base64
+- test/responses/response5.xml.base64
+- test/responses/response_eval.xml
+- test/responses/response_node_text_attack.xml.base64
+- test/responses/response_with_ampersands.xml
+- test/responses/response_with_ampersands.xml.base64
+- test/responses/response_with_concealed_signed_assertion.xml
+- test/responses/response_with_doubled_signed_assertion.xml
+- test/responses/response_with_multiple_attribute_statements.xml
+- test/responses/response_with_multiple_attribute_values.xml
+- test/responses/response_wrapped.xml.base64
+- test/responses/simple_saml_php.xml
+- test/responses/starfield_response.xml.base64
+- test/responses/valid_response.xml.base64
+- test/responses/wrapped_response_2.xml.base64
+- test/settings_test.rb
+- test/slo_logoutresponse_test.rb
+- test/test_helper.rb
+- test/utils_test.rb
+- test/xml_security_test.rb