saml-kit 1.4.1 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ce0f7fc307eddfbefa35cbf90a0efba6d38782e51c20e7aa16144e774d6a97d8
-  data.tar.gz: fd22e8f11f3b57d8dd7a305367362874eb5073d0b5ee1ffb0ae490a5a5a8fe43
+  metadata.gz: 6758626dbf26ac6ea50535978aead6d9046a6dd31662cff9eb962154a682380e
+  data.tar.gz: 8fd7df975fa700f8d969f77c2fff0f59e9829ef3bde7ab6f41a6b5a94cb208d7
 SHA512:
-  metadata.gz: 58984c2369ed1dc697d634cdde413d3f780de83759bcefd5b7354d1bbbf7ec4cc477ef6821d67915a00bc6b92c8477c2e4dfa991d83727fb1525bcfeb4b114c5
-  data.tar.gz: c7c3b3bb94cff25d9d9bb17b2d0e66600763cd302053f0182a261cba4a704af561e6f85167dd330ef2f4deef5c7e06e8eda19858749889c9f8859f24d03798c1
+  metadata.gz: 1e80fc106bbc6e06e167c0e5b6ce7b7f09d3bf7e471558533ec2a061089dc0367d60da5a393436a9feb3e8f5b12745193d7652c29f5d9cc9dae9ecd151a42a19
+  data.tar.gz: a3a39fcbff995f9ac1dceca502412efd165690fdd66b91d093f423d8cc1573486c95655b1f958746f98c682c48eba69357a8b058fef53d216e770c7e5b9d8620

data/CHANGELOG.md

@@ -1,4 +1,4 @@
-Version 1.4.1
+Version 1.5.0
 
 # Changelog
 All notable changes to this project will be documented in this file.
@@ -8,6 +8,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.5.0] - 2026-08-17
+### Security
+- Reject a `Response` or `Assertion` that carries no signature. A registered
+  issuer was previously enough to make an unsigned document valid, so anyone
+  who could reach the assertion consumer service could forge an assertion for
+  any user. (GHSA-hx7c-98jm-7r55)
+- Require an xml signature to reference the element it is attached to. A
+  signature was verified without checking which element it covered, so a valid
+  signature could be copied onto a forged element with the element it really
+  covered hidden in `saml:Advice` or `ds:Object`. (GHSA-q726-45rx-qvrw)
+
+### Changed
+This release rejects documents that 1.4.1 accepted. Each case below was
+exploitable or is a side effect of closing one that was.
+
+- An unsigned `Response` or `Assertion` is now invalid, even when its issuer is
+  registered. Set `configuration.signature_required = false` to restore the old
+  behaviour while an identity provider is being fixed; doing so accepts forged
+  assertions. Signing only the `Assertion` is still accepted, as is an unsigned
+  `AuthnRequest`, `LogoutRequest` or `LogoutResponse`.
+- `Response.build` on a `Configuration` with no signing key pair emits an
+  unsigned document, which now fails `valid?`. Call
+  `generate_key_pair_for(use: :signing)` or `add_key_pair`.
+- `Assertion.new` with an unsigned assertion as a `String` is now invalid,
+  because a bare assertion is the whole document and nothing else vouches for
+  it. Passing the same assertion as a node nested in a `Response` is unchanged.
+- A signature whose `ds:Reference` does not resolve to the element it hangs
+  off, or resolves to more than one element, adds an error on `:reference`.
+
+### Added
+- `Saml::Kit::Configuration#signature_required`, defaulting to `true`.
+
 ## [1.4.1] - 2026-08-14
 ### Changed
 - fix: decode encoded signature
@@ -110,7 +142,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Removed
 - Removed optional SessionNotOnOrAfter attribute from AuthnStatement.
 
-[Unreleased]: https://github.com/xlgmokha/saml-kit/compare/v1.4.1...HEAD
+[Unreleased]: https://github.com/xlgmokha/saml-kit/compare/v1.5.0...HEAD
+[1.5.0]: https://github.com/xlgmokha/saml-kit/compare/v1.4.1...v1.5.0
 [1.4.1]: https://github.com/xlgmokha/saml-kit/compare/v1.4.0...v1.4.1
 [1.4.0]: https://github.com/xlgmokha/saml-kit/compare/v1.3.0...v1.4.0
 [1.3.0]: https://github.com/xlgmokha/saml-kit/compare/v1.2.0...v1.3.0

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    saml-kit (1.4.1)
+    saml-kit (1.5.0)
       activemodel (>= 5.1)
       base64 (~> 0.1)
       cgi (~> 0.1)

data/lib/saml/kit/assertion.rb

@@ -89,9 +89,7 @@ module Saml
       end
 
       def decryptable?
-        return true unless encrypted?
-
-        !@cannot_decrypt
+        !encrypted? || !@cannot_decrypt
       end
 
       def to_s
@@ -100,6 +98,12 @@ module Saml
 
       private
 
+      # A nested Assertion is covered by the enclosing Response's policy; a
+      # bare one is the whole document and has nothing else vouching for it.
+      def signature_required_by_type?
+        to_nokogiri == to_nokogiri.document.root
+      end
+
       def decrypt(decryptor)
         encrypted_assertion = at_xpath('./xmlenc:EncryptedData')
         @encrypted = encrypted_assertion.present?

data/lib/saml/kit/concerns/trustable.rb

@@ -11,9 +11,15 @@ module Saml
       included do
         validate :must_have_valid_signature, unless: :signature_verified
         validate :must_be_registered
+        validate :must_be_signed, if: :signature_required?
         validate :must_be_trusted
       end
 
+      # Returns true when this document must carry a signature to be valid.
+      def signature_required?
+        configuration.signature_required && signature_required_by_type?
+      end
+
       # Returns true when the document has an embedded XML Signature or has
       # been verified externally.
       def signed?
@@ -65,9 +71,40 @@ module Saml
         errors.add(:provider, error_message(:unregistered))
       end
 
+      # Whether a document of this type is worthless unless signed.
+      #
+      # A request may legitimately arrive unsigned, which is what
+      # `WantAuthnRequestsSigned="false"` means, so the default is false. A
+      # document that asserts an identity carries no authenticity guarantee at
+      # all when unsigned, so Response and Assertion override this.
+      def signature_required_by_type?
+        false
+      end
+
+      def must_be_signed
+        return unless expected_type?
+        return if signature_covers_document?
+
+        errors.add(:base, error_message(:unsigned))
+      end
+
+      # Whether a signature exists over the content this document asserts.
+      # Response overrides this, because a signature on either the Response or
+      # the Assertion covers the identity being asserted.
+      def signature_covers_document?
+        signed?
+      end
+
+      # The trust counterpart of `signature_covers_document?`. Kept separate
+      # from the public `trusted?`, which answers the narrower question of
+      # whether *this* element's own signature is trusted.
+      def signature_trusted?
+        trusted?
+      end
+
       def must_be_trusted
-        return if trusted?
-        return if provider.present? && !signed?
+        return if signature_trusted?
+        return if !signature_required? && provider.present? && !signed?
 
         errors.add(:fingerprint, error_message(:invalid_fingerprint))
       end

data/lib/saml/kit/configuration.rb

@@ -46,6 +46,13 @@ module Saml
       attr_accessor :logger
       # The total allowable clock drift for session timeout validation.
       attr_accessor :clock_drift
+      # Whether a document that asserts an identity must carry a signature.
+      #
+      # An unsigned Response or Assertion proves nothing about who issued it,
+      # so this defaults to true and should stay that way. Set it to false only
+      # to keep an identity provider that signs nothing working while it is
+      # being fixed, and understand that doing so accepts forged assertions.
+      attr_accessor :signature_required
 
       def initialize
         @clock_drift = 30.seconds
@@ -55,6 +62,7 @@ module Saml
         @registry = DefaultRegistry.new
         @session_timeout = 3.hours
         @signature_method = :SHA256
+        @signature_required = true
         yield self if block_given?
       end
 

data/lib/saml/kit/locales/en.yml

@@ -11,6 +11,7 @@ en:
         must_contain_single_assertion: "must contain single Assertion."
         must_match_issuer: "must match entityId."
         unregistered: "is unregistered."
+        unsigned: "must be signed."
       AuthnRequest:
         invalid: "must contain AuthnRequest."
         invalid_fingerprint: "is not registered."
@@ -34,10 +35,12 @@ en:
         invalid_version: "must be 2.0."
         unregistered: "must originate from registered identity provider."
         must_contain_single_assertion: "must contain a single Assertion."
+        unsigned: "must be signed."
       Signature:
         certificate: "Not valid before %{not_before}. Not valid after %{not_after}."
         digest_value: "is invalid."
         empty: "is missing."
+        reference: "must reference the element it is attached to."
         signature: "is invalid."
       SPSSODescriptor:
         invalid: "must contain SPSSODescriptor."

data/lib/saml/kit/response.rb

@@ -41,10 +41,26 @@ module Saml
 
       private
 
+      def signature_required_by_type?
+        true
+      end
+
+      # `signed?` and `trusted?` deliberately report only this element's own
+      # signature, but signing only the Assertion is a common identity provider
+      # configuration, and that signature covers the identity being asserted.
+      def signature_covers_document?
+        signed? || assertion.signed?
+      end
+
+      def signature_trusted?
+        super || (assertion.signed? && assertion.trusted?)
+      end
+
       def must_be_valid_assertion
         assertion.valid?
         assertion.each_error do |attribute, error|
-          errors.add(attribute == :base ? :assertion : attribute, error)
+          attribute = :assertion if attribute == :base
+          errors.add(attribute, error) unless errors.added?(attribute, error)
         end
       end
 

data/lib/saml/kit/signature.rb

@@ -11,6 +11,7 @@ module Saml
 
       validate :validate_signature
       validate :validate_certificate
+      validate :validate_reference
 
       attr_reader :name
 
@@ -20,18 +21,24 @@ module Saml
       end
 
       # Returns the embedded X509 Certificate
+      #
+      # Memoized with a `defined?` guard rather than `||=` because a signature
+      # without KeyInfo legitimately has no certificate, and callers depend on
+      # the nil.
       def certificate
-        xpath = './ds:KeyInfo/ds:X509Data/ds:X509Certificate'
-        value = at_xpath(xpath).try(:text)
-        return if value.nil?
+        return @certificate if defined?(@certificate)
 
-        ::Xml::Kit::Certificate.new(value, use: :signing)
+        value = at_xpath('./ds:KeyInfo/ds:X509Data/ds:X509Certificate').try(:text)
+        @certificate =
+          value.nil? ? nil : ::Xml::Kit::Certificate.new(value, use: :signing)
       end
 
       # Returns true when the fingerprint of the certificate matches one of
       # the certificates registered in the metadata.
       def trusted?(metadata)
         return false if metadata.nil?
+        return false if certificate.nil?
+        return false unless reference.bound?
 
         metadata.matches?(certificate.fingerprint, use: :signing).present?
       end
@@ -66,15 +73,9 @@ module Saml
       end
 
       def transforms
-        xpath = xpath_for([
-          '.',
-          'ds:SignedInfo',
-          'ds:Reference',
-          'ds:Transforms',
-          'ds:Transform',
-          '@Algorithm',
-        ])
-        node.search(xpath, Saml::Kit::Document::NAMESPACES).try(:map, &:value)
+        xpath = './ds:SignedInfo/ds:Reference/ds:Transforms/ds:Transform'
+        node.search("#{xpath}/@Algorithm", Saml::Kit::Document::NAMESPACES)
+          .try(:map, &:value)
       end
 
       # Returns the XML Hash.
@@ -109,6 +110,17 @@ module Saml
         errors.add(:base, error.message)
       end
 
+      def validate_reference
+        return unless present?
+        return if reference.bound?
+
+        errors.add(:reference, error_message(:reference))
+      end
+
+      def reference
+        @reference ||= SignatureReference.new(node)
+      end
+
       def validate_certificate(now = Time.now.utc)
         return unless certificate.present?
         return if certificate.active?(now)
@@ -128,11 +140,7 @@ module Saml
       end
 
       def dsignature
-        @dsignature ||= Xmldsig::Signature.new(node, 'ID=$uri or @Id')
-      end
-
-      def xpath_for(segments)
-        segments.join('/')
+        @dsignature ||= Xmldsig::Signature.new(node, SignatureReference::ID_ATTR)
       end
     end
   end

data/lib/saml/kit/signature_reference.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+module Saml
+  module Kit
+    # This class is responsible for deciding whether an xml digital signature
+    # actually covers the element it is attached to.
+    #
+    # A cryptographically intact signature only proves that *some* element in
+    # the document is unmodified. xmldsig resolves a Reference by searching the
+    # whole document for a matching ID, so without this check an attacker can
+    # copy a valid signature onto a forged element and hide the element it
+    # really covers somewhere the schema still permits, e.g. saml:Advice or
+    # ds:Object.
+    class SignatureReference
+      # The id_attr handed to Xmldsig::Signature, which expands it into
+      # "//*[@ID=$uri or @Id=$uri]". Both resolvers must agree on this or the
+      # element we check is not the element that was digested.
+      ID_ATTR = 'ID=$uri or @Id'
+      XPATH = './ds:SignedInfo/ds:Reference'
+
+      def initialize(node)
+        @node = node
+      end
+
+      # Returns true when some Reference resolves to the element the signature
+      # hangs off, and resolves to nothing else.
+      #
+      # Every Reference lives inside ds:SignedInfo, which ds:SignatureValue
+      # covers, so an attacker replaying a signature cannot add a Reference or
+      # retarget an existing one. Finding our element among them is therefore
+      # enough. SAML 2.0 core 5.4.2 permits only one, but documents carrying
+      # more exist, and each extra Reference only widens what the signature
+      # already commits to.
+      def bound?
+        return @bound if defined?(@bound)
+
+        @bound = binds_parent_element?
+      end
+
+      private
+
+      attr_reader :node
+
+      def binds_parent_element?
+        return false if node.nil? || signed.nil?
+
+        references.any? { |reference| covers_signed_element?(reference) }
+      end
+
+      def covers_signed_element?(reference)
+        uri = reference.attribute('URI').try(:value).to_s
+        # An empty URI digests the whole document, so it covers every element in
+        # it and leaves nowhere to hide an original.
+        return true if uri.empty?
+
+        id.present? && uri == "##{id}" && resolves_to_signed_element?
+      end
+
+      # `bound?` memoizes the one answer this class exists to give, so only the
+      # XPath search below is worth caching; the rest are O(1) node lookups.
+      def signed
+        node.parent
+      end
+
+      def references
+        @references ||= node.search(XPATH, Saml::Kit::Document::NAMESPACES)
+      end
+
+      def id
+        signed.attribute('ID').try(:value) || signed.attribute('Id').try(:value)
+      end
+
+      # Duplicate IDs are only rejected when schema validation runs, and an
+      # XPath lookup silently returns the first match, so require exactly one.
+      def resolves_to_signed_element?
+        matches = node.document.xpath(
+          "//*[@#{ID_ATTR}=$uri]",
+          Saml::Kit::Document::NAMESPACES,
+          'uri' => id
+        )
+        matches.count == 1 && matches.first == signed
+      end
+    end
+  end
+end

data/lib/saml/kit/version.rb

@@ -2,6 +2,6 @@
 
 module Saml
   module Kit
-    VERSION = '1.4.1'
+    VERSION = '1.5.0'
   end
 end

data/lib/saml/kit.rb

@@ -44,6 +44,7 @@ require 'saml/kit/logout_request'
 require 'saml/kit/metadata'
 require 'saml/kit/deprecated/metadata'
 require 'saml/kit/null_assertion'
+require 'saml/kit/signature_reference'
 require 'saml/kit/organization'
 require 'saml/kit/parser'
 require 'saml/kit/composite_metadata'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: saml-kit
 version: !ruby/object:Gem::Version
-  version: 1.4.1
+  version: 1.5.0
 platform: ruby
 authors:
 - mo khan
@@ -413,6 +413,7 @@ files:
 - lib/saml/kit/rspec/have_xpath.rb
 - lib/saml/kit/service_provider_metadata.rb
 - lib/saml/kit/signature.rb
+- lib/saml/kit/signature_reference.rb
 - lib/saml/kit/version.rb
 - lib/saml/kit/xsd/MetadataExchange.xsd
 - lib/saml/kit/xsd/oasis-200401-wss-wssecurity-secext-1.0.xsd