saml-kit 1.5.0 → 1.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6758626dbf26ac6ea50535978aead6d9046a6dd31662cff9eb962154a682380e
-  data.tar.gz: 8fd7df975fa700f8d969f77c2fff0f59e9829ef3bde7ab6f41a6b5a94cb208d7
+  metadata.gz: 55bb650eff422a517582801633097c71478c4294f5cc8a4ff5bd3842545609ff
+  data.tar.gz: 2b9dfe74c62d2c04cd83453f9a579a4192a854b87124de15e92d49375d31000b
 SHA512:
-  metadata.gz: 1e80fc106bbc6e06e167c0e5b6ce7b7f09d3bf7e471558533ec2a061089dc0367d60da5a393436a9feb3e8f5b12745193d7652c29f5d9cc9dae9ecd151a42a19
-  data.tar.gz: a3a39fcbff995f9ac1dceca502412efd165690fdd66b91d093f423d8cc1573486c95655b1f958746f98c682c48eba69357a8b058fef53d216e770c7e5b9d8620
+  metadata.gz: b89dcaf5a139f92e8bd641bada1226a738aaaf92a06dbfcf2004f628f4e7f56822ae4aad6276f961bb1cce7b4e9482e388d3b0e24ce90b431ab7fd187d1b3db9
+  data.tar.gz: a98cb7a584d24fe7a0a7093d6e1028c27d777c2d26a42b621d1d5793adee1bc7e214140a2bcaeb04d14f74ee82519cdbb01ae7fbe774d005f0567a7a07c1739d

data/CHANGELOG.md

@@ -1,4 +1,4 @@
-Version 1.5.0
+Version 1.5.1
 
 # Changelog
 All notable changes to this project will be documented in this file.
@@ -8,6 +8,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.5.1] - 2026-08-18
+### Fixed
+- Compile the SAML XSDs without `Dir.chdir`. Schema compilation ran inside a
+  `Dir.chdir` block, which mutates process global state, so two threads
+  validating a document at the same time could raise `conflicting chdir during
+  another chdir block`. Each schema is now parsed as a document carrying its own
+  path, so its relative imports resolve without changing the working directory.
+- Compile each XSD once instead of on every `valid?` call.
+
 ## [1.5.0] - 2026-08-17
 ### Security
 - Reject a `Response` or `Assertion` that carries no signature. A registered
@@ -142,7 +151,8 @@ exploitable or is a side effect of closing one that was.
 ### Removed
 - Removed optional SessionNotOnOrAfter attribute from AuthnStatement.
 
-[Unreleased]: https://github.com/xlgmokha/saml-kit/compare/v1.5.0...HEAD
+[Unreleased]: https://github.com/xlgmokha/saml-kit/compare/v1.5.1...HEAD
+[1.5.1]: https://github.com/xlgmokha/saml-kit/compare/v1.5.0...v1.5.1
 [1.5.0]: https://github.com/xlgmokha/saml-kit/compare/v1.4.1...v1.5.0
 [1.4.1]: https://github.com/xlgmokha/saml-kit/compare/v1.4.0...v1.4.1
 [1.4.0]: https://github.com/xlgmokha/saml-kit/compare/v1.3.0...v1.4.0

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    saml-kit (1.5.0)
+    saml-kit (1.5.1)
       activemodel (>= 5.1)
       base64 (~> 0.1)
       cgi (~> 0.1)

data/lib/saml/kit/concerns/xsd_validatable.rb

@@ -13,15 +13,42 @@ module Saml
         '../xsd/saml-schema-metadata-2.0.xsd', File.dirname(__FILE__)
       ).freeze
 
+      @schemas = {}
+      @monitor = Mutex.new
+
+      class << self
+        # Validation treats a schema as read only, so one instance is shared
+        # across threads. The hit path reads without the lock, which at worst
+        # compiles the same schema twice on rubies that lack a global lock.
+        #
+        # @!visibility private
+        def schema_for(path)
+          @schemas[path] || @monitor.synchronize do
+            @schemas[path] ||= compile(path)
+          end
+        end
+
+        private
+
+        # The xsd is parsed as a document carrying its own path as a base uri,
+        # so the relative schemaLocation imports in our xsds resolve against
+        # the xsd's own directory. A bare String carries no base uri and would
+        # resolve them against the working directory instead, which is what
+        # Dir.chdir used to paper over at the cost of crashing under threads.
+        def compile(path)
+          Nokogiri::XML::Schema.from_document(
+            Nokogiri::XML::Document.parse(File.read(path), url: path)
+          )
+        end
+      end
+
       # @!visibility private
-      def matches_xsd?(xsd)
+      def matches_xsd?(path)
         return unless to_nokogiri.present?
 
-        Dir.chdir(File.dirname(xsd)) do
-          xsd = Nokogiri::XML::Schema(IO.read(xsd))
-          xsd.validate(to_nokogiri.document).each do |error|
-            errors.add(:base, error.message)
-          end
+        schema = XsdValidatable.schema_for(path)
+        schema.validate(to_nokogiri.document).each do |error|
+          errors.add(:base, error.message)
         end
       end
     end

data/lib/saml/kit/version.rb

@@ -2,6 +2,6 @@
 
 module Saml
   module Kit
-    VERSION = '1.5.0'
+    VERSION = '1.5.1'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: saml-kit
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.5.1
 platform: ruby
 authors:
 - mo khan