samlr 2.7.1.pre.2 → 2.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ffda3aac7b18a3c419d1d3ee4bf06cadfd1795bf751ee72fff8346ca0de6f3dd
-  data.tar.gz: 552eca0e0bcf195bfb321ba1c35bcdd083c69f88b243e92136a84c7c4fa191b8
+  metadata.gz: 981235b1e8b9c47db48aa1ad9dd69103f68766c4e9f247980e2482f5c0130f38
+  data.tar.gz: ffda22321c9f2cb8564681747e426f59dc9cd77aed0761bb71e88d5c43ac393d
 SHA512:
-  metadata.gz: 51f778fe6656c13a7f76f5a529a65b0b7bc86f1df3fd43a544c848c526c62cd8dfef3ecb65de6d7f9b980180c85c4994e6fa7769d817ca9e944adfa48477b10e
-  data.tar.gz: 24a81740c250ff4e81a2c7c522c3aae918c235404a9e1543fc602df9aca12f961128d46cee769dbe4ba87608db85086fc9251fe787ee7871b4b883fa602130aa
+  metadata.gz: 3001de515250f4deb3fff83454aab102c7c72a712304206a88a398b4a5db4f0aa00fc618ae9c85964b8ccfd60cefbc7b13b2fccb50820851b8257e22943a64af
+  data.tar.gz: df04ff380856705c2b15ce7bdbde71708c12d5d8ae3c518debfcd6f7042987fd7b347433bb09eb7f69f5391ac5f30feb3589756e51e34fa3b0da30d068b62700

data/lib/samlr/signature.rb

@@ -17,14 +17,8 @@ module Samlr
       @options  = options
       @signature = nil
 
-      # TODO: This option exists only in a pre-release version to allow testing the feature; remove it from the final release
-      if options[:skip_signature_reference_checking]
-        @signature = @document.at("#{prefix}/ds:Signature", NS_MAP)
-      else
-        id = @document.at("#{prefix}", NS_MAP)&.attribute('ID')
-        @signature = @document.at("#{prefix}/ds:Signature/ds:SignedInfo/ds:Reference[@URI='##{id}']", NS_MAP)&.parent&.parent if id
-      end
-      @signature.remove if @signature # enveloped signatures only
+      id = @document.at("#{prefix}", NS_MAP)&.attribute('ID')
+      @signature = find_signature_for_element_id(id) if id
 
       @fingerprint = if options[:fingerprint]
         Fingerprint.from_string(options[:fingerprint])
@@ -45,17 +39,19 @@ module Samlr
       raise SignatureError.new("No signature at #{prefix}/ds:Signature") unless present?
 
       verify_fingerprint! unless options[:skip_fingerprint]
-      verify_digests!
-      verify_signature!
+      verify_signature!  # Do this first while signature is still available
+      verify_digests!    # This may remove enveloped signatures
 
       true
     end
 
     def references
       @references ||= [].tap do |refs|
-        original.xpath("#{prefix}/ds:Signature/ds:SignedInfo/ds:Reference[@URI]", NS_MAP).each do |ref|
+        refs_xpath = @signature.xpath("./ds:SignedInfo/ds:Reference[@URI]", NS_MAP)
+        refs_xpath.each do |ref|
           refs << Samlr::Reference.new(ref)
         end
+
       end
     end
 
@@ -72,6 +68,18 @@ module Samlr
 
     # Tests that the document content has not been edited
     def verify_digests!
+      # Check if we need to remove an enveloped signature
+      if @signature && !@signature_removed
+        signed_element = @document.at("#{prefix}", NS_MAP)
+        is_enveloped = signed_element&.xpath(".//ds:Signature", NS_MAP)&.include?(@signature)
+
+        # Remove enveloped signature for digest verification
+        if is_enveloped
+          @signature.remove
+          @signature_removed = true
+        end
+      end
+
       references.each do |reference|
         node    = referenced_node(reference.uri)
         canoned = node.canonicalize(C14N, reference.namespaces)
@@ -85,11 +93,14 @@ module Samlr
 
     # Tests correctness of the signature (and hence digests)
     def verify_signature!
-      node      = original.at("#{prefix}/ds:Signature/ds:SignedInfo", NS_MAP)
-      canoned   = node.canonicalize(C14N)
+      # Cache the canonicalized SignedInfo to avoid DOM issues with multiple verifications
+      unless @canonicalized_signed_info
+        node = @signature.at("./ds:SignedInfo", NS_MAP)
+        @canonicalized_signed_info = node.canonicalize(C14N)
+      end
 
-      unless x509.public_key.verify(signature_method.new, decoded_signature_value, canoned)
-        raise SignatureError.new("Signature validation error: Possible canonicalization mismatch", "This canonicalizer returns #{canoned}")
+      unless x509.public_key.verify(signature_method.new, decoded_signature_value, @canonicalized_signed_info)
+        raise SignatureError.new("Signature validation error: Possible canonicalization mismatch", "This canonicalizer returns #{@canonicalized_signed_info}")
       end
     end
 
@@ -135,5 +146,13 @@ module Samlr
     def certificate_node
       signature.at("./ds:KeyInfo/ds:X509Data/ds:X509Certificate", NS_MAP)
     end
+
+    def find_signature_for_element_id(element_id)
+      return nil unless element_id
+
+      return @document.at_xpath("//ds:Signature[ds:SignedInfo/ds:Reference[@URI='##{element_id}']]", NS_MAP)
+
+    end
+
   end
 end

data/lib/samlr/version.rb

@@ -1,3 +1,3 @@
 module Samlr
-  VERSION = "2.7.1.pre.2"
+  VERSION = "2.7.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: samlr
 version: !ruby/object:Gem::Version
-  version: 2.7.1.pre.2
+  version: 2.7.1
 platform: ruby
 authors:
 - Morten Primdahl
@@ -10,41 +10,27 @@ cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: nokogiri
+  name: base64
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.5.5
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.5.5
-- !ruby/object:Gem::Dependency
-  name: uuidtools
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 2.1.3
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.1.3
+        version: '0'
 - !ruby/object:Gem::Dependency
-  name: rake
+  name: cgi
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  type: :development
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
@@ -52,13 +38,13 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: bundler
+  name: logger
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  type: :development
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
@@ -66,33 +52,33 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: minitest
+  name: nokogiri
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
+        version: 1.5.5
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 1.5.5
 - !ruby/object:Gem::Dependency
-  name: bump
+  name: uuidtools
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
+        version: 2.1.3
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 2.1.3
 description: Helps you implement a SAML SP
 email: primdahl@me.com
 executables:
@@ -145,7 +131,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.7'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="