ruby-saml 0.8.3 → 0.8.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f4097d7f4bcd13aa1ca745797b87159cc5980617
-  data.tar.gz: 9b70f265ae75b3dafe2884b001f138d3e21e515b
+  metadata.gz: f485d8f86fc7bab5dccd17139c2b4c47f06d2ca7
+  data.tar.gz: b01df64b87b3eb6f6765960dc8bc4a5f7c4349dc
 SHA512:
-  metadata.gz: 00c0b519afbb725de8464e61676681abfc6235fdc6756f87384623a044d7fc5ccb9a939d051229da9dc946e4a2983de9d970729c7e6ac27fa84c5cffad3ced51
-  data.tar.gz: 6dc1aaa0d3c472374ae20f7a6d401df09899b9e44c93fe71f149bf299cc8b26f199949703424a13c6a4b3f83cde856ed38f3ecbf283ab8e48066646af655989b
+  metadata.gz: 88de3d60dadfb99be4e9158aaedae71165144150b8f88104c2cc130567ca61f859eebf0ca39ca44f4da56dbd1f36f2bfb8cbb66e2337a4da8cb3359703432cef
+  data.tar.gz: 2c4fce97b7b9ff0c4763199dd6b0a3f926fcc349617e5d2b5b717f5a131856fa2736ba85992ecf9a256801875ff6e919961363a1031652c52a1d80b2b742d66e

data/changelog.md

@@ -1,5 +1,8 @@
 # RubySaml Changelog
 
+### 0.8.4 (March 5, 2018)
+* Improve the fix for CVE-2017-11428 to parse CDATA properly
+
 ### 0.8.3 (Feb 27, 2018)
 * Fix vulnerability CVE-2017-11428. Process text of nodes properly, ignoring comments
 * Fix DigestMethod lookup bug #144

data/lib/onelogin/ruby-saml/utils.rb

@@ -8,7 +8,7 @@ module OneLogin
       # that there all children other than text nodes can be ignored (e.g. comments). If nil is
       # passed, nil will be returned.
       def self.element_text(element)
-        element.texts.join if element
+        element.texts.map(&:value).join if element
       end
     end
   end

data/lib/onelogin/ruby-saml/version.rb

@@ -1,5 +1,5 @@
 module OneLogin
   module RubySaml
-    VERSION = '0.8.3'
+    VERSION = '0.8.4'
   end
 end

data/test/utils_test.rb

@@ -0,0 +1,41 @@
+require File.expand_path(File.join(File.dirname(__FILE__), "test_helper"))
+
+class UtilsTest < Test::Unit::TestCase
+  context "Utils" do
+    context 'element_text' do
+      should 'returns the element text' do
+        element = REXML::Document.new('<element>element text</element>').elements.first
+        assert_equal 'element text', OneLogin::RubySaml::Utils.element_text(element)
+      end
+
+      should 'returns all segments of the element text' do
+        element = REXML::Document.new('<element>element <!-- comment -->text</element>').elements.first
+        assert_equal 'element text', OneLogin::RubySaml::Utils.element_text(element)
+      end
+
+      should 'returns normalized element text' do
+        element = REXML::Document.new('<element>element &amp; text</element>').elements.first
+        assert_equal 'element & text', OneLogin::RubySaml::Utils.element_text(element)
+      end
+
+      should 'returns the CDATA element text' do
+        element = REXML::Document.new('<element><![CDATA[element & text]]></element>').elements.first
+        assert_equal 'element & text', OneLogin::RubySaml::Utils.element_text(element)
+      end
+
+      should 'returns the element text with newlines and additional whitespace' do
+        element = REXML::Document.new("<element>  element \n text  </element>").elements.first
+        assert_equal "  element \n text  ", OneLogin::RubySaml::Utils.element_text(element)
+      end
+
+      should 'returns nil when element is nil' do
+        assert_nil OneLogin::RubySaml::Utils.element_text(nil)
+      end
+
+      should 'returns empty string when element has no text' do
+        element = REXML::Document.new('<element></element>').elements.first
+        assert_equal '', OneLogin::RubySaml::Utils.element_text(element)
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ruby-saml
 version: !ruby/object:Gem::Version
-  version: 0.8.3
+  version: 0.8.4
 platform: ruby
 authors:
 - OneLogin LLC
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-02-27 00:00:00.000000000 Z
+date: 2018-03-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: uuid
@@ -99,6 +99,7 @@ files:
 - test/responses/wrapped_response_2.xml.base64
 - test/settings_test.rb
 - test/test_helper.rb
+- test/utils_test.rb
 - test/xml_security_test.rb
 homepage: http://github.com/onelogin/ruby-saml
 licenses: []
@@ -153,4 +154,5 @@ test_files:
 - test/responses/wrapped_response_2.xml.base64
 - test/settings_test.rb
 - test/test_helper.rb
+- test/utils_test.rb
 - test/xml_security_test.rb