ruby-saml 1.12.3 → 1.13.0

data/lib/xml_security.rb

@@ -159,15 +159,13 @@ module XMLSecurity
       x509_cert_element.text = Base64.encode64(certificate.to_der).gsub(/\n/, "")
 
       # add the signature
-      issuer_element = self.elements["//saml:Issuer"]
+      issuer_element = elements["//saml:Issuer"]
       if issuer_element
-        self.root.insert_after issuer_element, signature_element
+        root.insert_after(issuer_element, signature_element)
+      elsif first_child = root.children[0]
+        root.insert_before(first_child, signature_element)
       else
-        if sp_sso_descriptor = self.elements["/md:EntityDescriptor"]
-          self.root.insert_before sp_sso_descriptor, signature_element
-        else
-          self.root.add_element(signature_element)
-        end
+        root.add_element(signature_element)
       end
     end
 
@@ -312,30 +310,17 @@ module XMLSecurity
       canon_string = noko_signed_info_element.canonicalize(canon_algorithm)
       noko_sig_element.remove
 
-      # get signed info
-      signed_info_element = REXML::XPath.first(
-        sig_element,
-        "./ds:SignedInfo",
-        { "ds" => DSIG }
-      )
-
       # get inclusive namespaces
       inclusive_namespaces = extract_inclusive_namespaces
 
       # check digests
-      ref = REXML::XPath.first(signed_info_element, "./ds:Reference", {"ds"=>DSIG})
-
-      reference_nodes = document.xpath("//*[@ID=$id]", nil, { 'id' => extract_signed_element_id })
+      ref = REXML::XPath.first(sig_element, "//ds:Reference", {"ds"=>DSIG})
 
-      if reference_nodes.length > 1 # ensures no elements with same ID to prevent signature wrapping attack.
-        return append_error("Duplicated IDs found", soft)
-      end
-
-      hashed_element = reference_nodes[0]
+      hashed_element = document.at_xpath("//*[@ID=$id]", nil, { 'id' => extract_signed_element_id })
 
       canon_algorithm = canon_algorithm REXML::XPath.first(
-        signed_info_element,
-        './ds:CanonicalizationMethod',
+        ref,
+        '//ds:CanonicalizationMethod',
         { "ds" => DSIG }
       )
 
@@ -345,13 +330,13 @@ module XMLSecurity
 
       digest_algorithm = algorithm(REXML::XPath.first(
         ref,
-        "./ds:DigestMethod",
+        "//ds:DigestMethod",
         { "ds" => DSIG }
       ))
       hash = digest_algorithm.digest(canon_hashed_element)
       encoded_digest_value = REXML::XPath.first(
         ref,
-        "./ds:DigestValue",
+        "//ds:DigestValue",
         { "ds" => DSIG }
       )
       digest_value = Base64.decode64(OneLogin::RubySaml::Utils.element_text(encoded_digest_value))
@@ -377,7 +362,7 @@ module XMLSecurity
     def process_transforms(ref, canon_algorithm)
       transforms = REXML::XPath.match(
         ref,
-        "./ds:Transforms/ds:Transform",
+        "//ds:Transforms/ds:Transform",
         { "ds" => DSIG }
       )
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ruby-saml
 version: !ruby/object:Gem::Version
-  version: 1.12.3
+  version: 1.13.0
 platform: ruby
 authors:
 - OneLogin LLC
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-09-10 00:00:00.000000000 Z
+date: 2021-09-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri
@@ -173,13 +173,14 @@ extra_rdoc_files:
 - README.md
 files:
 - ".document"
+- ".github/workflows/test.yml"
 - ".gitignore"
-- ".travis.yml"
+- CHANGELOG.md
 - Gemfile
 - LICENSE
 - README.md
 - Rakefile
-- changelog.md
+- UPGRADING.md
 - gemfiles/nokogiri-1.5.gemfile
 - lib/onelogin/ruby-saml.rb
 - lib/onelogin/ruby-saml/attribute_service.rb
@@ -220,7 +221,7 @@ homepage: https://github.com/onelogin/ruby-saml
 licenses:
 - MIT
 metadata: {}
-post_install_message:
+post_install_message: 
 rdoc_options:
 - "--charset=UTF-8"
 require_paths:
@@ -236,8 +237,9 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.26
-signing_key:
+rubyforge_project: 
+rubygems_version: 2.5.2.1
+signing_key: 
 specification_version: 4
 summary: SAML Ruby Tookit
 test_files: []

data/.travis.yml

@@ -1,48 +0,0 @@
-language: ruby
-rvm:
-  - 1.9.3
-  - 2.0.0
-  - 2.1.10
-  - 2.2.10
-  - 2.3.8
-  - 2.4.6
-  - 2.5.8
-  - 2.6.6
-  - 2.7.2
-  - 3.0.0
-  - jruby-1.7.27
-  - jruby-9.1.17.0
-  - jruby-9.2.13.0
-gemfile:
-  - Gemfile
-  - gemfiles/nokogiri-1.5.gemfile
-before_install:
-  - gem update bundler
-matrix:
-  exclude:
-    - rvm: jruby-1.7.27
-      gemfile: gemfiles/nokogiri-1.5.gemfile
-    - rvm: jruby-9.1.17.0
-      gemfile: gemfiles/nokogiri-1.5.gemfile
-    - rvm: jruby-9.2.13.0
-      gemfile: gemfiles/nokogiri-1.5.gemfile
-    - rvm: 2.1.5
-      gemfile: gemfiles/nokogiri-1.5.gemfile
-    - rvm: 2.1.10
-      gemfile: gemfiles/nokogiri-1.5.gemfile
-    - rvm: 2.2.10
-      gemfile: gemfiles/nokogiri-1.5.gemfile
-    - rvm: 2.3.8
-      gemfile: gemfiles/nokogiri-1.5.gemfile
-    - rvm: 2.4.6
-      gemfile: gemfiles/nokogiri-1.5.gemfile
-    - rvm: 2.5.8
-      gemfile: gemfiles/nokogiri-1.5.gemfile
-    - rvm: 2.6.6
-      gemfile: gemfiles/nokogiri-1.5.gemfile
-    - rvm: 2.7.2
-      gemfile: gemfiles/nokogiri-1.5.gemfile
-    - rvm: 3.0.0
-      gemfile: gemfiles/nokogiri-1.5.gemfile
-env:
-  - JRUBY_OPTS="--debug"