saml2 2.2.3 → 2.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4738dcfc5520adfcf8de16d6bc1d5416fba979d3d98245846da68f08732db743
-  data.tar.gz: 93437ef60321d3f7ceef5927e6849df7853d9b905c73e0fe3c253ac5eccf6f80
+  metadata.gz: 9ddfa80997c8cd9e463d41bd14dfd213653d1b20b4b65ef9d65e4e01023d7d51
+  data.tar.gz: 0afbd8222cf2f7450983780c013892a46525f0bf1db118e7e6cc11f15675b4c0
 SHA512:
-  metadata.gz: 771cd1a6c06c4246440b31efdeca1d65fce49e5d43809a65e74917b97e1543727deaa280d9bc3ba7f286fdbe9fe88fbdf566d9949988f1067e8be98c3adba0a5
-  data.tar.gz: 3a21a953e2f9d4141124e58b2680877acbcd93e1100cb7444f058a71b2a07ef9a54fed2ed84265b92d50e064ae5c9354c53a22b57aff5f0cfdaab826c63d8bfa
+  metadata.gz: 0b69c37f7f9df28d7776a388dd6e3382868941d4d2130e0e0842feae7194dfad7e8bdf21c87130d23ac14baffdcb8662a56147eb82e8cf979fb3f4f1c255ce39
+  data.tar.gz: 31dd8a893d188aaed40b997f80a2298c22cceee3280907f158e92485a43c6aa487ec43643afb3e9c2c61835aeb849f2199924d37ad90b615b36eee62ec1b88d3

data/lib/saml2/assertion.rb

@@ -14,8 +14,8 @@ module SAML2
 
     def from_xml(node)
       super
-      @conditions = nil
       @statements = nil
+      remove_instance_variable(:@conditions)
     end
 
     # @return [Subject, nil]
@@ -28,7 +28,10 @@ module SAML2
 
     # @return [Conditions]
     def conditions
-      @conditions ||= Conditions.from_xml(xml.at_xpath('saml:Conditions', Namespaces::ALL))
+      if !instance_variable_defined?(:@conditions) && xml
+        @conditions = Conditions.from_xml(xml.at_xpath('saml:Conditions', Namespaces::ALL))
+      end
+      @conditions
     end
 
     # @return [Array<AuthnStatement]
@@ -55,7 +58,7 @@ module SAML2
 
         subject.build(assertion)
 
-        conditions.build(assertion)
+        conditions.build(assertion) if conditions
 
         statements.each { |stmt| stmt.build(assertion) }
       end

data/lib/saml2/conditions.rb

@@ -11,6 +11,7 @@ module SAML2
 
     # (see Base.from_xml)
     def self.from_xml(node)
+      return nil unless node
       result = new
       result.from_xml(node)
       result

data/lib/saml2/response.rb

@@ -185,7 +185,7 @@ module SAML2
 
       # only do our own issue instant validation if the assertion
       # doesn't mandate any
-      unless assertion.conditions.not_on_or_after
+      unless assertion.conditions&.not_on_or_after
         if assertion.issue_instant +  5 * 60 < verification_time ||
             assertion.issue_instant - 5 * 60 > verification_time
           errors << "assertion not recently issued"
@@ -193,8 +193,9 @@ module SAML2
         end
       end
 
-      unless (condition_errors = assertion.conditions.validate(verification_time: verification_time,
-                                                               audience: service_provider.entity_id)).empty?
+      if assertion.conditions &&
+          !(condition_errors = assertion.conditions.validate(verification_time: verification_time,
+                                                             audience: service_provider.entity_id)).empty?
         return errors.concat(condition_errors)
       end
 

data/lib/saml2/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SAML2
-  VERSION = '2.2.3'
+  VERSION = '2.2.4'
 end

data/spec/fixtures/noconditions_response.xml

@@ -0,0 +1 @@
+<samlp:Response ID="_8BE49FED716A72AC7F522E48FB0AAD60" Version="2.0" IssueInstant="2018-06-02T17:10:55.181Z" Destination="https://school.instructure.com/login/saml" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://login.school.org:9000/SSO/CanvasIndex</saml:Issuer><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><Reference URI="#_8BE49FED716A72AC7F522E48FB0AAD60"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><InclusiveNamespaces PrefixList="#default samlp saml ds xs xsi" xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" /></Transform></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><DigestValue>JLUChoHqec/YsCvAbA5IyZec+SI=</DigestValue></Reference></SignedInfo><SignatureValue>Zyz2cx4zwPXZrIJS0Tviio41F13yqRAlCGZQN6attC9w/vUf+l0dDinWP0cIpmKTSTxm0ZvwQsxb1hOhHNMVmgl1enKxAS51vSn1UDLLAwumlv3+hb0PBNkOrdfgxXXNUPJvJokBMGvEQl5Iy2YRQUlmpY49NfLIWfbgI55YqGg=</SignatureValue><KeyInfo><X509Data><X509Certificate></X509Certificate></X509Data></KeyInfo></Signature><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></samlp:Status><saml:Assertion Version="2.0" ID="_7B628E4F6D162193D406C05E2BF19920" IssueInstant="2018-06-02T17:10:55.181Z" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><saml:Issuer>https://login.school.org:9000/SSO/CanvasIndex</saml:Issuer><saml:Subject><saml:NameID>user@school.edu</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2028-06-02T10:10:55.181Z" Recipient="https://school.instructure.com/login/saml" /></saml:SubjectConfirmation></saml:Subject><saml:AuthnStatement AuthnInstant="2018-06-02T17:10:55.181Z"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement></saml:Assertion></samlp:Response>

data/spec/lib/response_spec.rb

@@ -109,6 +109,11 @@ module SAML2
       expect(response.assertions.first.subject.name_id.id).to eq 'testuser@example.com'
     end
 
+    it "doesn't choke on missing Conditions" do
+      response = Response.parse(fixture("noconditions_response.xml"))
+      expect(response.assertions.first.conditions).to eq nil
+    end
+
     describe "#validate" do
       let (:idp_entity) do
         idp_entity = Entity.new("issuer")

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: saml2
 version: !ruby/object:Gem::Version
-  version: 2.2.3
+  version: 2.2.4
 platform: ruby
 authors:
 - Cody Cutrer
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-04-25 00:00:00.000000000 Z
+date: 2018-06-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri
@@ -186,6 +186,7 @@ files:
 - spec/fixtures/entities.xml
 - spec/fixtures/external-uri-reference-response.xml
 - spec/fixtures/identity_provider.xml
+- spec/fixtures/noconditions_response.xml
 - spec/fixtures/othercertificate.pem
 - spec/fixtures/privatekey.key
 - spec/fixtures/response_signed.xml
@@ -263,6 +264,7 @@ test_files:
 - spec/fixtures/response_tampered_signature.xml
 - spec/fixtures/xml_missigned_assertion.xml
 - spec/fixtures/certificate.pem
+- spec/fixtures/noconditions_response.xml
 - spec/fixtures/entities.xml
 - spec/fixtures/xml_signature_wrapping_attack_duplicate_ids.xml
 - spec/fixtures/othercertificate.pem