samlr 2.7.1.pre.2 → 2.7.1.pre.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ffda3aac7b18a3c419d1d3ee4bf06cadfd1795bf751ee72fff8346ca0de6f3dd
-  data.tar.gz: 552eca0e0bcf195bfb321ba1c35bcdd083c69f88b243e92136a84c7c4fa191b8
+  metadata.gz: 99111c7af501ed1d300602d81d603fe0869e042dc9b330cb38aa800c77a79517
+  data.tar.gz: 755f39f3397bdff3454a05bd47c329ebbf0440c4103469153ed3518bf1aa47c1
 SHA512:
-  metadata.gz: 51f778fe6656c13a7f76f5a529a65b0b7bc86f1df3fd43a544c848c526c62cd8dfef3ecb65de6d7f9b980180c85c4994e6fa7769d817ca9e944adfa48477b10e
-  data.tar.gz: 24a81740c250ff4e81a2c7c522c3aae918c235404a9e1543fc602df9aca12f961128d46cee769dbe4ba87608db85086fc9251fe787ee7871b4b883fa602130aa
+  metadata.gz: 49bb0ebfda779df0a6950eaedac7487b5c1a03475b488573b028d4b86b51a1cbf16c641ad09f15e3bae9bc8717795572d59103590b456b82f22879347881a4d2
+  data.tar.gz: f111bab5d4b7f933bf217b7bd0a2c89d179768409fc0215e78e9c0a739ebf8bf5860fb481ec4c94da9e352da7c6975f8293003acc19160c03d04e2ae38bd8577

data/lib/samlr/signature.rb

@@ -20,11 +20,11 @@ module Samlr
       # TODO: This option exists only in a pre-release version to allow testing the feature; remove it from the final release
       if options[:skip_signature_reference_checking]
         @signature = @document.at("#{prefix}/ds:Signature", NS_MAP)
+        @signature.remove if @signature # enveloped signatures only
       else
         id = @document.at("#{prefix}", NS_MAP)&.attribute('ID')
-        @signature = @document.at("#{prefix}/ds:Signature/ds:SignedInfo/ds:Reference[@URI='##{id}']", NS_MAP)&.parent&.parent if id
+        @signature = find_signature_for_element_id(id) if id
       end
-      @signature.remove if @signature # enveloped signatures only
 
       @fingerprint = if options[:fingerprint]
         Fingerprint.from_string(options[:fingerprint])
@@ -45,17 +45,30 @@ module Samlr
       raise SignatureError.new("No signature at #{prefix}/ds:Signature") unless present?
 
       verify_fingerprint! unless options[:skip_fingerprint]
-      verify_digests!
-      verify_signature!
+      if options[:skip_signature_reference_checking]
+        verify_digests!
+        verify_signature!
+      else
+        verify_signature!  # <- Do this first while signature is still available
+        verify_digests!    # <- This can remove the signature
+      end
 
       true
     end
 
     def references
       @references ||= [].tap do |refs|
-        original.xpath("#{prefix}/ds:Signature/ds:SignedInfo/ds:Reference[@URI]", NS_MAP).each do |ref|
-          refs << Samlr::Reference.new(ref)
+        if options[:skip_signature_reference_checking]
+          original.xpath("#{prefix}/ds:Signature/ds:SignedInfo/ds:Reference[@URI]", NS_MAP).each do |ref|
+            refs << Samlr::Reference.new(ref)
+          end
+        else
+          refs_xpath = @signature.xpath("./ds:SignedInfo/ds:Reference[@URI]", NS_MAP)
+          refs_xpath.each do |ref|
+            refs << Samlr::Reference.new(ref)
+          end
         end
+
       end
     end
 
@@ -72,24 +85,58 @@ module Samlr
 
     # Tests that the document content has not been edited
     def verify_digests!
-      references.each do |reference|
-        node    = referenced_node(reference.uri)
-        canoned = node.canonicalize(C14N, reference.namespaces)
-        digest  = reference.digest_method.digest(canoned)
+      if options[:skip_signature_reference_checking]
+        references.each do |reference|
+          node    = referenced_node(reference.uri)
+          canoned = node.canonicalize(C14N, reference.namespaces)
+          digest  = reference.digest_method.digest(canoned)
+
+          if digest != reference.decoded_digest_value
+            raise SignatureError.new("Reference validation error: Digest mismatch for #{reference.uri}")
+          end
+        end
+      else
+        # Check if we need to remove an enveloped signature
+        if @signature && !@signature_removed
+          signed_element = @document.at("#{prefix}", NS_MAP)
+          is_enveloped = signed_element&.xpath(".//ds:Signature", NS_MAP)&.include?(@signature)
+
+          # Remove enveloped signature for digest verification
+          if is_enveloped
+            @signature.remove
+            @signature_removed = true
+          end
+        end
 
-        if digest != reference.decoded_digest_value
-          raise SignatureError.new("Reference validation error: Digest mismatch for #{reference.uri}")
+        references.each do |reference|
+          node    = referenced_node(reference.uri)
+          canoned = node.canonicalize(C14N, reference.namespaces)
+          digest  = reference.digest_method.digest(canoned)
+
+          if digest != reference.decoded_digest_value
+            raise SignatureError.new("Reference validation error: Digest mismatch for #{reference.uri}")
+          end
         end
       end
     end
 
     # Tests correctness of the signature (and hence digests)
     def verify_signature!
-      node      = original.at("#{prefix}/ds:Signature/ds:SignedInfo", NS_MAP)
-      canoned   = node.canonicalize(C14N)
-
-      unless x509.public_key.verify(signature_method.new, decoded_signature_value, canoned)
-        raise SignatureError.new("Signature validation error: Possible canonicalization mismatch", "This canonicalizer returns #{canoned}")
+      if options[:skip_signature_reference_checking]
+        node = original.at("#{prefix}/ds:Signature/ds:SignedInfo", NS_MAP)
+        canoned = node.canonicalize(C14N)
+        unless x509.public_key.verify(signature_method.new, decoded_signature_value, canoned)
+          raise SignatureError.new("Signature validation error: Possible canonicalization mismatch", "This canonicalizer returns #{canoned}")
+        end
+      else
+        # Cache the canonicalized SignedInfo to avoid DOM issues with multiple verifications
+        unless @canonicalized_signed_info
+          node = @signature.at("./ds:SignedInfo", NS_MAP)
+          @canonicalized_signed_info = node.canonicalize(C14N)
+        end
+        unless x509.public_key.verify(signature_method.new, decoded_signature_value, @canonicalized_signed_info)
+          raise SignatureError.new("Signature validation error: Possible canonicalization mismatch", "This canonicalizer returns #{@canonicalized_signed_info}")
+        end
       end
     end
 
@@ -135,5 +182,13 @@ module Samlr
     def certificate_node
       signature.at("./ds:KeyInfo/ds:X509Data/ds:X509Certificate", NS_MAP)
     end
+
+    def find_signature_for_element_id(element_id)
+      return nil unless element_id
+
+      return @document.at_xpath("//ds:Signature[ds:SignedInfo/ds:Reference[@URI='##{element_id}']]", NS_MAP)
+
+    end
+
   end
 end

data/lib/samlr/version.rb

@@ -1,3 +1,3 @@
 module Samlr
-  VERSION = "2.7.1.pre.2"
+  VERSION = "2.7.1.pre.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: samlr
 version: !ruby/object:Gem::Version
-  version: 2.7.1.pre.2
+  version: 2.7.1.pre.3
 platform: ruby
 authors:
 - Morten Primdahl
@@ -37,6 +37,34 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 2.1.3
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -66,7 +94,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: minitest
+  name: bump
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -80,7 +108,21 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: bump
+  name: minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '6.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '6.0'
+- !ruby/object:Gem::Dependency
+  name: minitest-mock
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="