samlesa 2.18.2 → 2.18.4

package/build/src/binding-artifact.js

@@ -384,7 +384,7 @@ async function parseLoginResponseResolve(params) {
         }
         samlContent = verifiedAssertionNode1;
         // 改进的postFlow函数中关于签名验证的部分
-        const verificationResult = libsaml.verifySignature(samlContent, verificationOptions, self);
+        const verificationResult = await libsaml.verifySignature(samlContent, verificationOptions, self);
         // 检查验证结果
         if (!verificationResult.status) {
             // 如果验证失败，根据具体情况返回错误

package/build/src/extractor.js

@@ -173,7 +173,24 @@ export const loginResponseFields = assertion => [
         attributePath: ['AttributeValue'],
         attributes: [],
         shortcut: assertion
-    }
+    },
+    {
+        key: 'subjectConfirmation',
+        localPath: ['Assertion', 'Subject', 'SubjectConfirmation', 'SubjectConfirmationData'],
+        attributes: ['Recipient', 'InResponseTo', 'NotOnOrAfter'],
+        shortcut: assertion
+    },
+    {
+        key: 'oneTimeUse',
+        localPath: ['Assertion', 'Conditions', 'OneTimeUse'],
+        attributes: [],
+        shortcut: assertion
+    },
+    {
+        key: 'status',
+        localPath: ['Response', 'Status', 'StatusCode'],
+        attributes: ['Value']
+    },
 ];
 export const logoutRequestFields = [
     {

package/build/src/flow.js

@@ -107,7 +107,7 @@ async function redirectFlow(options) {
     if (parserType === 'SAMLResponse'
         && extractedProperties.conditions
         && !verifyTime(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) {
-        return Promise.reject('ERR_SUBJECT_UNCONFIRMED');
+        return Promise.reject('ERR_CONDITION_UNCONFIRMED');
     }
     if (parserType === 'SAMLResponse') {
         let destination = extractedProperties?.response?.destination;
@@ -151,107 +151,8 @@ async function postFlow(options) {
     // check status based on different scenarios
     await checkStatus(samlContent, parserType);
     /**检查签名顺序 */
-    /*
-        const [verified, verifiedAssertionNode, isDecryptRequired, noSignature] = libsaml.verifySignature(samlContent, verificationOptions);
-        decryptRequired = isDecryptRequired
-        if (isDecryptRequired && noSignature) {
-    
-            const result = await libsaml.decryptAssertion(self, samlContent);
-            samlContent = result[0];
-            extractorFields = getDefaultExtractorFields(parserType, result[1]);
-        }
-        if (!verified && !noSignature && !isDecryptRequired) {
-    
-            return Promise.reject('ERR_FAIL_TO_VERIFY_ETS_SIGNATURE');
-        }
-        if (!isDecryptRequired) {
-    
-            extractorFields = getDefaultExtractorFields(parserType, verifiedAssertionNode);
-        }
-        if (parserType === 'SAMLResponse' && isDecryptRequired && !noSignature) {
-            const result = await libsaml.decryptAssertion(self, samlContent);
-            samlContent = result[0];
-            extractorFields = getDefaultExtractorFields(parserType, result[1]);
-    console.log("走这里来了=========")
-            console.log(result[1])
-        }
-    
-    
-        const parseResult = {
-            samlContent: samlContent,
-            extract: extract(samlContent, extractorFields),
-        };
-        /!**
-         *  Validation part: validate the context of response after signature is verified and decrypted (optional)
-         *!/
-        const targetEntityMetadata = from.entityMeta;
-        const issuer = targetEntityMetadata.getEntityID();
-        const extractedProperties = parseResult.extract;
-        // unmatched issuer
-        if (
-            (parserType === 'LogoutResponse' || parserType === 'SAMLResponse')
-            && extractedProperties
-            && extractedProperties.issuer !== issuer
-        ) {
-            return Promise.reject('ERR_UNMATCH_ISSUER');
-        }
-    
-        // invalid session time
-        // only run the verifyTime when `SessionNotOnOrAfter` exists
-        if (
-            parserType === 'SAMLResponse'
-            && extractedProperties.sessionIndex.sessionNotOnOrAfter
-            && !verifyTime(
-                undefined,
-                extractedProperties.sessionIndex.sessionNotOnOrAfter,
-                self.entitySetting.clockDrifts
-            )
-        ) {
-            return Promise.reject('ERR_EXPIRED_SESSION');
-        }
-    
-        // invalid time
-        // 2.4.1.2 https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
-        if (
-            parserType === 'SAMLResponse'
-            && extractedProperties.conditions
-            && !verifyTime(
-                extractedProperties.conditions.notBefore,
-                extractedProperties.conditions.notOnOrAfter,
-                self.entitySetting.clockDrifts
-            )
-        ) {
-            return Promise.reject('ERR_SUBJECT_UNCONFIRMED');
-        }
-        //valid destination
-        //There is no validation of the response here. The upper-layer application
-        // should verify the result by itself to see if the destination is equal to the SP acs and
-        // whether the response.id is used to prevent replay attacks.
-        /!*
-            let destination = extractedProperties?.response?.destination
-            let isExit = self.entitySetting?.assertionConsumerService?.filter((item) => {
-                return item?.Location === destination
-            })
-            if (isExit?.length === 0) {
-                return Promise.reject('ERR_Destination_URL');
-            }
-            if (parserType === 'SAMLResponse') {
-                let destination = extractedProperties?.response?.destination
-                let isExit = self.entitySetting?.assertionConsumerService?.filter((item: { Location: any; }) => {
-                    return item?.Location === destination
-                })
-                if (isExit?.length === 0) {
-                    return Promise.reject('ERR_Destination_URL');
-                }
-            }
-        *!/
-    
-    
-        return Promise.resolve(parseResult);*/
     // 改进的postFlow函数中关于签名验证的部分
-    const verificationResult = libsaml.verifySignature(samlContent, verificationOptions, self);
-    /*    console.log(verificationResult)
-        console.log("解析对象")*/
+    const verificationResult = await libsaml.verifySignature(samlContent, verificationOptions, self);
     let resultObject = {
         isMessageSigned: true, //是否有外层的消息签名（Response或者Request 等最外层的签名）
         MessageSignatureStatus: true, //外层的签名是否经过验证
@@ -261,7 +162,8 @@ async function postFlow(options) {
         decrypted: true, //断言加密后断言是否解密成功，
         status: true, //是否全部通过验证,
         samlContent: 'xxx', //xxx是通过验证后 解密后的整个响应，
-        assertionContent: 'xxx', //xxx是通过验证后 解密后的整个响应中的assertion 断言部分字符串
+        assertionContent: 'xxx', //xxx是通过验证后 解密后的整个响应中的assertion 断言部分字符串,
+        signMethod: "", //xxx是通过验证后 解密后的整个响应中的assertion 断言部分字符串,
     };
     // 检查验证结果
     if (!verificationResult.status) {
@@ -323,31 +225,126 @@ async function postFlow(options) {
     if (parserType === 'SAMLResponse'
         && extractedProperties.conditions
         && !verifyTime(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) {
+        return Promise.reject('ERR_CONDITION_SESSION');
+    }
+    // invalid subjectConfirmation time
+    // invalid time
+    // 2.4.1.2 https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
+    if (parserType === 'SAMLResponse'
+        && extractedProperties.subjectConfirmation
+        && !verifyTime(undefined, extractedProperties.subjectConfirmation.notOnOrAfter, self.entitySetting.clockDrifts)) {
         return Promise.reject('ERR_SUBJECT_UNCONFIRMED');
     }
     //valid destination
     //There is no validation of the response here. The upper-layer application
     // should verify the result by itself to see if the destination is equal to the SP acs and
     // whether the response.id is used to prevent replay attacks.
-    /*
-        let destination = extractedProperties?.response?.destination
-        let isExit = self.entitySetting?.assertionConsumerService?.filter((item) => {
-            return item?.Location === destination
-        })
-        if (isExit?.length === 0) {
-            return Promise.reject('ERR_Destination_URL');
-        }
-        if (parserType === 'SAMLResponse') {
-            let destination = extractedProperties?.response?.destination
-            let isExit = self.entitySetting?.assertionConsumerService?.filter((item: { Location: any; }) => {
+    console.log(extractedProperties);
+    console.log("牛逼属性");
+    /*        let destination = extractedProperties?.response?.destination
+            let isExit = self.entitySetting?.assertionConsumerService?.filter((item) => {
                 return item?.Location === destination
             })
             if (isExit?.length === 0) {
                 return Promise.reject('ERR_Destination_URL');
             }
-        }
-    */
-    return Promise.resolve(parseResult);
+            if (parserType === 'SAMLResponse') {
+                let destination = extractedProperties?.response?.destination
+                let isExit = self.entitySetting?.assertionConsumerService?.filter((item: { Location: any; }) => {
+                    return item?.Location === destination
+                })
+                if (isExit?.length === 0) {
+                    return Promise.reject('ERR_Destination_URL');
+                }
+            }*/
+    // ============================
+    // VALIDATE Destination & Recipient
+    // ============================
+    const { type } = verificationResult;
+    const { response, subjectConfirmation } = extractedProperties || {};
+    // 获取 SP 配置的所有合法 ACS URLs（用于比对）
+    const validACSUrls = (self.entitySetting?.assertionConsumerService || [])
+        .map((item) => item.Location)
+        .filter(Boolean);
+    /**
+     * Helper: Check if a given URL is in the list of valid ACS endpoints
+     */
+    function isValidACSEndpoint(url) {
+        return url != null && validACSUrls.includes(url);
+    }
+    // 根据消息类型执行不同的验证
+    switch (type) {
+        case 'Response': // SAML Response (Login)
+            {
+                // 1. 验证协议层 Destination（必须匹配 ACS）
+                const destination = response?.destination;
+                if (!isValidACSEndpoint(destination)) {
+                    return Promise.reject('ERR_INVALID_DESTINATION');
+                }
+                // 2. 验证断言层 Recipient（必须匹配 ACS，且通常应等于 Destination）
+                const recipient = subjectConfirmation?.recipient;
+                if (!isValidACSEndpoint(recipient)) {
+                    return Promise.reject('ERR_INVALID_RECIPIENT');
+                }
+                // 可选：强制 Destination === Recipient（推荐）
+                if (destination !== recipient) {
+                    // 注意：某些 IdP 可能不严格一致，但安全起见建议开启
+                    return Promise.reject('ERR_DESTINATION_RECIPIENT_MISMATCH');
+                }
+            }
+            break;
+        case 'LogoutRequest': // IdP 发起的单点登出
+            {
+                // LogoutRequest 是 IdP → SP，SP 是接收方
+                // 必须验证 Destination 是否为 SP 的 SLO endpoint（Single Logout Service）
+                const destination = response?.destination; // 注意：LogoutRequest 的 root 元素是 <samlp:LogoutRequest>
+                const validSLOUrls = (self.entitySetting?.singleLogoutService || [])
+                    .map((item) => item.Location)
+                    .filter(Boolean);
+                if (destination && !validSLOUrls.includes(destination)) {
+                    return Promise.reject('ERR_INVALID_LOGOUT_DESTINATION');
+                }
+                // LogoutRequest 通常**不包含 Assertion**，所以无 Recipient
+                // 如果有嵌套断言（罕见），可额外处理，但一般不需要
+            }
+            break;
+        case 'LogoutResponse': // SP → IdP 的登出响应
+            {
+                // LogoutResponse 是 SP → IdP，IdP 是接收方
+                // 此时 SP 是发送方，**不应验证 Destination 是否属于自身**
+                // 而应由 IdP 验证。因此 SP 端通常**跳过 Destination 验证**
+                // 但如果你作为 SP 也要校验（比如防止发错），可对比 IdP 的 SLO URL
+                // —— 但你的 entityMeta 是 SP 自身，没有 IdP 的 SLO，所以一般不验
+                // ✅ 所以：LogoutResponse 在 SP 端通常**无需验证 Destination/Recipient**
+            }
+            break;
+        case 'AuthnRequest': // SP → IdP 的认证请求
+            {
+                // AuthnRequest 是 SP 发出的，不是接收的
+                // 此验证逻辑运行在 SP 接收响应时，**不会收到 AuthnRequest**
+                // 所以这个 case 实际不会触发，保留仅为完整性
+            }
+            break;
+        case 'Unknown':
+        default:
+            // 未知类型，保守拒绝
+            return Promise.reject('ERR_UNKNOWN_SAML_MESSAGE_TYPE');
+    }
+    return Promise.resolve({
+        ...parseResult,
+        verificationResult: {
+            isMessageSigned: verificationResult?.isMessageSigned,
+            MessageSignatureStatus: verificationResult?.MessageSignatureStatus,
+            isAssertionSigned: verificationResult?.isAssertionSigned,
+            AssertionSignatureStatus: verificationResult?.AssertionSignatureStatus,
+            encrypted: verificationResult?.encrypted,
+            decrypted: verificationResult?.decrypted,
+            type: verificationResult?.type, // 添加类型字段
+            status: verificationResult?.status,
+            hasUnsafeSignatureAlgorithm: verificationResult?.hasUnsafeSignatureAlgorithm,
+            unsafeSignatureAlgorithm: verificationResult?.unsafeSignatureAlgorithm
+        },
+    });
 }
 // proceed the post Artifact flow
 async function postArtifactFlow(options) {
@@ -372,9 +369,7 @@ async function postArtifactFlow(options) {
     await checkStatus(samlContent, parserType);
     /**检查签名顺序 */
     // 改进的postFlow函数中关于签名验证的部分
-    const verificationResult = libsaml.verifySignature(samlContent, verificationOptions, self);
-    console.log(verificationResult);
-    console.log("最终结果====");
+    const verificationResult = await libsaml.verifySignature(samlContent, verificationOptions, self);
     // 检查验证结果
     if (!verificationResult.status) {
         // 如果验证失败，根据具体情况返回错误
@@ -428,7 +423,7 @@ async function postArtifactFlow(options) {
     if (parserType === 'SAMLResponse'
         && extractedProperties.conditions
         && !verifyTime(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) {
-        return Promise.reject('ERR_SUBJECT_UNCONFIRMED');
+        return Promise.reject('ERR_CONDITION_UNCONFIRMED');
     }
     //valid destination
     //There is no validation of the response here. The upper-layer application
@@ -533,7 +528,7 @@ async function postSimpleSignFlow(options) {
     if (parserType === 'SAMLResponse'
         && extractedProperties.conditions
         && !verifyTime(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) {
-        return Promise.reject('ERR_SUBJECT_UNCONFIRMED');
+        return Promise.reject('ERR_CONDITION_UNCONFIRMED');
     }
     if (parserType === 'SAMLResponse') {
         let destination = extractedProperties?.response?.destination;
@@ -568,7 +563,8 @@ export function checkStatus(content, parserType, soap) {
         throw new Error('ERR_UNDEFINED_STATUS');
     }
     // returns a detailed error for two-tier error code
-    throw new Error(`ERR_FAILED_STATUS with top tier code: ${top}, second tier code: ${second}`);
+    throw new Error('ERR_UNDEFINED_STATUS');
+    /*  throw new Error(`ERR_FAILED_STATUS with top tier code: ${top}, second tier code: ${second}`);*/
 }
 export function flow(options) {
     const binding = options.binding;

package/build/src/libsaml.js

@@ -7,7 +7,7 @@ import { X509Certificate } from 'node:crypto';
 import xml from 'xml';
 import utility, { flattenDeep, inflateString, isString } from './utility.js';
 import { algorithms, namespace, wording } from './urn.js';
-import { select } from 'xpath';
+import xpath, { select } from 'xpath';
 import nrsa from 'node-rsa';
 import { SignedXml } from 'xml-crypto';
 import * as xmlenc from 'xml-encryption';
@@ -48,6 +48,25 @@ const libSaml = () => {
         'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256': 'RSA-SHA256',
         'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512': 'RSA-SHA512',
     };
+    /**
+     * 检测是否使用了不安全的SHA1系列签名算法
+     * @param signatureAlgorithm 签名算法URI
+     * @returns {Object} 包含是否使用不安全算法和具体算法名称的对象
+     */
+    function checkUnsafeSignatureAlgorithm(signatureAlgorithm) {
+        const unsafeAlgorithms = [
+            'http://www.w3.org/2000/09/xmldsig#rsa-sha1',
+            'http://www.w3.org/2000/09/xmldsig#dsa-sha1',
+            'http://www.w3.org/2000/09/xmldsig#hmac-sha1',
+            'http://www.w3.org/2000/09/xmldsig#sha1'
+        ];
+        const isUnsafe = unsafeAlgorithms.some(alg => signatureAlgorithm.toLowerCase().includes('sha1') ||
+            signatureAlgorithm === 'http://www.w3.org/2000/09/xmldsig#rsa-sha1');
+        return {
+            hasUnsafeSignatureAlgorithm: isUnsafe,
+            unsafeSignatureAlgorithm: isUnsafe ? signatureAlgorithm : null
+        };
+    }
     /**
      * @desc Default login request template
      * @type {LoginRequestTemplate}
@@ -229,6 +248,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
         defaultLogoutResponseTemplate,
         defaultAttributeValueTemplate,
         validateAndInflateSamlResponse,
+        checkUnsafeSignatureAlgorithm,
         /**
          * @desc Replace the tag (e.g. {tag}) inside the raw XML
          * @param  {string} rawXML      raw XML string used to do keyword replacement
@@ -294,7 +314,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
          * @desc Construct the XML signature for POST binding
          * @param  {string} rawSamlMessage      request/response xml string
          * @param  {string} referenceTagXPath    reference uri
-         * @param  {string} privateKey           declares the private key
+         * @param  {string} privateKey           declares the private key-
          * @param  {string} passphrase           passphrase of the private key [optional]
          * @param  {string|buffer} signingCert   signing certificate
          * @param  {string} signatureAlgorithm   signature algorithm
@@ -368,201 +388,6 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                 };
             }
         },
-        /**
-         * @desc Verify the XML signature
-         * @param  {string} xml xml
-         * @param  {SignatureVerifierOptions} opts cert declares the X509 certificate
-         * @return {[boolean, string | null]} - A tuple where:
-         *   - The first element is `true` if the signature is valid, `false` otherwise.
-         *   - The second element is the cryptographically authenticated assertion node as a string, or `null` if not found.
-         */
-        // tslint:disable-next-line:no-shadowed-variable
-        verifySignature1(xml, opts) {
-            const { dom } = getContext();
-            const doc = dom.parseFromString(xml, 'application/xml');
-            const docParser = new DOMParser();
-            // In order to avoid the wrapping attack, we have changed to use absolute xpath instead of naively fetching the signature element
-            const LogoutResponseSignatureXpath = "/*[local-name()='LogoutResponse']/*[local-name()='Signature']";
-            const logoutRequestSignatureXpath = "/*[local-name()='LogoutRequest']/*[local-name()='Signature']";
-            // message signature (logout response / saml response)
-            const messageSignatureXpath = "/*[contains(local-name(), 'Response') or contains(local-name(), 'Request')]/*[local-name(.)='Signature']";
-            // assertion signature (logout response / saml response)
-            const assertionSignatureXpath = "/*[contains(local-name(), 'Response') or contains(local-name(), 'Request')]/*[local-name(.)='Assertion']/*[local-name(.)='Signature']";
-            // check if there is a potential malicious wrapping signature
-            const wrappingElementsXPath = "/*[contains(local-name(), 'Response')]/*[local-name(.)='Assertion']/*[local-name(.)='Subject']/*[local-name(.)='SubjectConfirmation']/*[local-name(.)='SubjectConfirmationData']//*[local-name(.)='Assertion' or local-name(.)='Signature']";
-            // const wrappingElementsXPath = "/*[contains(local-name(), 'Response')]/*[local-name(.)='Assertion']/*[local-name(.)='Subject']/*[local-name(.)='SubjectConfirmation']/*[local-name(.)='SubjectConfirmationData']//*[local-name(.)='Assertion' or local-name(.)='Signature']";
-            // @ts-expect-error misssing Node properties are not needed
-            const encryptedAssertions = select("/*[contains(local-name(), 'Response')]/*[local-name(.)='EncryptedAssertion']", doc);
-            const encAssertionNode = encryptedAssertions[0];
-            // select the signature node
-            let selection = [];
-            // @ts-expect-error misssing Node properties are not needed
-            const messageSignatureNode = select(messageSignatureXpath, doc);
-            // @ts-expect-error misssing Node properties are not needed
-            const assertionSignatureNode = select(assertionSignatureXpath, doc);
-            // @ts-expect-error misssing Node properties are not needed
-            const wrappingElementNode = select(wrappingElementsXPath, doc);
-            // @ts-expect-error misssing Node properties are not needed
-            const LogoutResponseSignatureElementNode = select(LogoutResponseSignatureXpath, doc);
-            // try to catch potential wrapping attack
-            if (wrappingElementNode.length !== 0) {
-                throw new Error('ERR_POTENTIAL_WRAPPING_ATTACK');
-            }
-            // 优先检测 LogoutRequest 签名
-            // @ts-expect-error missing Node properties
-            const logoutRequestSignature = select(logoutRequestSignatureXpath, doc);
-            if (logoutRequestSignature.length > 0) {
-                selection = selection.concat(logoutRequestSignature);
-            }
-            selection = selection.concat(messageSignatureNode);
-            selection = selection.concat(assertionSignatureNode);
-            selection = selection.concat(LogoutResponseSignatureElementNode);
-            // guarantee to have a signature in saml response
-            if (selection.length === 0) {
-                /** 判断有没有加密如果没有加密返回 [false, null]*/
-                if (encryptedAssertions.length > 0) {
-                    console.log("走加密了====");
-                    if (!Array.isArray(encryptedAssertions) || encryptedAssertions.length === 0) {
-                        return [false, null, false, true]; // we return false now
-                    }
-                    if (encryptedAssertions.length > 1) {
-                        throw new Error('ERR_MULTIPLE_ASSERTION');
-                    }
-                    return [false, null, true, true]; // return encryptedAssert
-                }
-            }
-            if (selection.length !== 0) {
-                console.log("走加密了1====");
-                /** 判断有没有加密如果没有加密返回 [false, null]*/
-                if (logoutRequestSignature.length === 0 && LogoutResponseSignatureElementNode.length === 0 && encryptedAssertions.length > 0) {
-                    if (!Array.isArray(encryptedAssertions) || encryptedAssertions.length === 0) {
-                        return [false, null, true, false]; // we return false now
-                    }
-                    if (encryptedAssertions.length > 1) {
-                        throw new Error('ERR_MULTIPLE_ASSERTION');
-                    }
-                    return [false, null, true, false]; // return encryptedAssert
-                }
-            }
-            // need to refactor later on
-            for (const signatureNode of selection) {
-                const sig = new SignedXml();
-                let verified = false;
-                sig.signatureAlgorithm = opts.signatureAlgorithm;
-                if (!opts.keyFile && !opts.metadata) {
-                    throw new Error('ERR_UNDEFINED_SIGNATURE_VERIFIER_OPTIONS');
-                }
-                console.log("开始1");
-                if (opts.keyFile) {
-                    console.log("开始11");
-                    let publicCertResult = this.validateCertificate(fs.readFileSync(opts.keyFile));
-                    console.log(publicCertResult);
-                    console.log("结果");
-                    sig.publicCert = fs.readFileSync(opts.keyFile);
-                }
-                if (opts.metadata) {
-                    console.log("开始111");
-                    const certificateNode = select(".//*[local-name(.)='X509Certificate']", signatureNode);
-                    // certificate in metadata
-                    let metadataCert = opts.metadata.getX509Certificate(certUse.signing);
-                    // flattens the nested array of Certificates from each KeyDescriptor
-                    if (Array.isArray(metadataCert)) {
-                        metadataCert = flattenDeep(metadataCert);
-                    }
-                    else if (typeof metadataCert === 'string') {
-                        metadataCert = [metadataCert];
-                    }
-                    // normalise the certificate string
-                    metadataCert = metadataCert.map(utility.normalizeCerString);
-                    // no certificate in node  response nor metadata
-                    if (certificateNode.length === 0 && metadataCert.length === 0) {
-                        throw new Error('NO_SELECTED_CERTIFICATE');
-                    }
-                    // certificate node in response
-                    if (certificateNode.length !== 0) {
-                        const x509CertificateData = certificateNode[0].firstChild.data;
-                        const x509Certificate = utility.normalizeCerString(x509CertificateData);
-                        if (metadataCert.length >= 1 &&
-                            !metadataCert.find(cert => cert.trim() === x509Certificate.trim())) {
-                            // keep this restriction for rolling certificate usage
-                            // to make sure the response certificate is one of those specified in metadata
-                            throw new Error('ERROR_UNMATCH_CERTIFICATE_DECLARATION_IN_METADATA');
-                        }
-                        let publicCertResult = this.validateCertificate(x509Certificate);
-                        console.log(publicCertResult);
-                        console.log("结果");
-                        sig.publicCert = this.getKeyInfo(x509Certificate).getKey();
-                    }
-                    else {
-                        console.log("开始11111");
-                        // Select first one from metadata
-                        let publicCertResult = this.validateCertificate(metadataCert[0]);
-                        console.log(publicCertResult);
-                        console.log("结果");
-                        sig.publicCert = this.getKeyInfo(metadataCert[0]).getKey();
-                    }
-                }
-                sig.loadSignature(signatureNode);
-                verified = sig.checkSignature(doc.toString());
-                // immediately throw error when any one of the signature is failed to get verified
-                if (!verified) {
-                    throw new Error('ERR_FAILED_TO_VERIFY_SIGNATURE');
-                }
-                // attempt is made to get the signed Reference as a string();
-                // note, we don't have access to the actual signedReferences API unfortunately
-                // mainly a sanity check here for SAML. (Although ours would still be secure, if multiple references are used)
-                if (!(sig.getSignedReferences().length >= 1)) {
-                    throw new Error('NO_SIGNATURE_REFERENCES');
-                }
-                const signedVerifiedXML = sig.getSignedReferences()[0];
-                const rootNode = docParser.parseFromString(signedVerifiedXML, 'application/xml').documentElement;
-                // process the verified signature:
-                // case 1, rootSignedDoc is a response:
-                if (rootNode?.localName === 'Response') {
-                    // try getting the Xml from the first assertion
-                    const EncryptedAssertions = select("./*[local-name()='EncryptedAssertion']", 
-                    // @ts-expect-error misssing Node properties are not needed
-                    rootNode);
-                    const assertions = select("./*[local-name()='Assertion']", 
-                    // @ts-expect-error misssing Node properties are not needed
-                    rootNode);
-                    /**第三个参数代表是否加密*/
-                    // now we can process the assertion as an assertion
-                    if (EncryptedAssertions.length === 1) {
-                        /** 已加密*/
-                        return [true, EncryptedAssertions[0].toString(), true, false];
-                    }
-                    if (assertions.length === 1) {
-                        return [true, assertions[0].toString(), false, false];
-                    }
-                }
-                else if (rootNode?.localName === 'Assertion') {
-                    return [true, rootNode.toString(), false, false];
-                }
-                else if (rootNode?.localName === 'EncryptedAssertion') {
-                    return [true, rootNode.toString(), true, false];
-                }
-                else if (rootNode?.localName === 'LogoutRequest') {
-                    return [true, rootNode.toString(), false, false];
-                }
-                else if (rootNode?.localName === 'LogoutResponse') {
-                    return [true, rootNode.toString(), false, false];
-                }
-                else {
-                    return [true, null, false, false]; // signature is valid. But there is no assertion node here. It could be metadata node, hence return null
-                }
-            }
-            // something has gone seriously wrong if we are still here
-            return [false, null, false, true]; // return encryptedAssert
-            /*   throw new Error('ERR_ZERO_SIGNATURE');*/
-        },
-        /**
-         * 改进的SAML签名验证函数，支持多种签名和加密组合场景
-         * @param xml SAML XML内容
-         * @param opts 验证选项
-         * @param self
-         * @returns 验证结果对象
-         */
         /**
          * 改进的SAML签名验证函数，支持多种签名和加密组合场景
          * @param xml SAML XML内容
@@ -570,7 +395,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
          * @param self
          * @returns 验证结果对象
          */
-        verifySignature(xml, opts, self) {
+        async verifySignature(xml, opts, self) {
             const { dom } = getContext();
             const doc = dom.parseFromString(xml, 'application/xml');
             const docParser = new DOMParser();
@@ -638,6 +463,8 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                         type = 'Unknown';
                     }
             }
+            let hasUnsafeSignatureAlgorithm = false;
+            let unsafeSignatureAlgorithm = '';
             // 特殊情况：带未签名断言的未签名SAML响应，应该拒绝
             if (!isMessageSigned && !isAssertionSigned && !encrypted) {
                 return {
@@ -650,7 +477,9 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                     type, // 添加类型字段
                     status: false, // 明确拒绝未签名未加密的响应
                     samlContent,
-                    assertionContent
+                    assertionContent,
+                    hasUnsafeSignatureAlgorithm,
+                    unsafeSignatureAlgorithm
                 };
             }
             // 处理最外层有签名且断言加密的情况（关键逻辑补充）
@@ -660,6 +489,12 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                     const result = this.decryptAssertionSync(self, xml, opts);
                     // 更新文档为解密后的版本
                     samlContent = result[0];
+                    let res = await this.isValidXml(samlContent).catch((error) => {
+                        return Promise.reject('ERR_EXCEPTION_VALIDATE_XML');
+                    });
+                    if (res !== true) {
+                        return Promise.reject('ERR_EXCEPTION_VALIDATE_XML');
+                    }
                     assertionContent = result[1];
                     // 更新验证状态
                     decrypted = true;
@@ -669,6 +504,11 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                     const decryptedDoc = dom.parseFromString(samlContent, 'application/xml');
                     // 2. 验证最外层消息签名（使用解密后的文档）
                     const signatureNode = messageSignatureNode[0];
+                    // @ts-expect-error misssing Node properties are not needed
+                    const signatureAlgorithm = xpath.select1(".//*[local-name(.)='SignatureMethod']/@Algorithm", signatureNode);
+                    let checkResult = checkUnsafeSignatureAlgorithm(signatureAlgorithm.value || '');
+                    hasUnsafeSignatureAlgorithm = checkResult.hasUnsafeSignatureAlgorithm;
+                    unsafeSignatureAlgorithm = checkResult.unsafeSignatureAlgorithm ?? "";
                     const sig = new SignedXml();
                     if (!opts.keyFile && !opts.metadata) {
                         throw new Error('ERR_UNDEFINED_SIGNATURE_VERIFIER_OPTIONS');
@@ -707,8 +547,6 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                     sig.loadSignature(signatureNode);
                     // 使用解密后的文档验证最外层签名.默认采用的都是采用的先签名后加密的顺序，对应sp应该先解密 然后验证签名。 如果解密后验证外层签名失败有可能是先加密后签名，此时sp应该直接验证没解密的外层签名
                     MessageSignatureStatus = sig.checkSignature(decryptedDoc.toString());
-                    console.log(MessageSignatureStatus);
-                    console.log("验证MessageSignatureStatus==========================");
                     if (!MessageSignatureStatus) {
                         /** 签名验证失败 再直接验证外层*/
                         let MessageSignatureStatus2 = sig.checkSignature(xml);
@@ -734,6 +572,11 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             // 处理最外层有签名但断言未加密的情况
             else if (isMessageSigned && !encrypted) {
                 const signatureNode = messageSignatureNode[0];
+                // @ts-expect-error misssing Node properties are not needed
+                const signatureAlgorithm = xpath.select1(".//*[local-name(.)='SignatureMethod']/@Algorithm", signatureNode);
+                let checkResult = checkUnsafeSignatureAlgorithm(signatureAlgorithm.value || '');
+                hasUnsafeSignatureAlgorithm = checkResult.hasUnsafeSignatureAlgorithm;
+                unsafeSignatureAlgorithm = checkResult.unsafeSignatureAlgorithm ?? "";
                 const sig = new SignedXml();
                 if (!opts.keyFile && !opts.metadata) {
                     throw new Error('ERR_UNDEFINED_SIGNATURE_VERIFIER_OPTIONS');
@@ -767,7 +610,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                         sig.publicCert = this.getKeyInfo(metadataCert[0]).getKey();
                     }
                 }
-                sig.signatureAlgorithm = opts.signatureAlgorithm;
+                sig.signatureAlgorithm = signatureAlgorithm.value;
                 // @ts-expect-error misssing Node properties are not needed
                 sig.loadSignature(signatureNode);
                 MessageSignatureStatus = sig.checkSignature(doc.toString());
@@ -778,6 +621,11 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             // 验证断言级签名（如果存在且未加密）
             if (isAssertionSigned && !encrypted) {
                 const signatureNode = assertionSignatureNode[0];
+                // @ts-expect-error misssing Node properties are not needed
+                const signatureAlgorithm = xpath.select1(".//*[local-name(.)='SignatureMethod']/@Algorithm", signatureNode);
+                let checkResult = checkUnsafeSignatureAlgorithm(signatureAlgorithm.value || '');
+                hasUnsafeSignatureAlgorithm = checkResult.hasUnsafeSignatureAlgorithm;
+                unsafeSignatureAlgorithm = checkResult.unsafeSignatureAlgorithm ?? "";
                 const sig = new SignedXml();
                 if (!opts.keyFile && !opts.metadata) {
                     throw new Error('ERR_UNDEFINED_SIGNATURE_VERIFIER_OPTIONS');
@@ -811,6 +659,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                         sig.publicCert = this.getKeyInfo(metadataCert[0]).getKey();
                     }
                 }
+                // 检测不安全的签名算法
                 sig.signatureAlgorithm = opts.signatureAlgorithm;
                 // @ts-expect-error misssing Node properties are not needed
                 sig.loadSignature(signatureNode);
@@ -840,6 +689,12 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                 // 解密断言
                 try {
                     const result = this.decryptAssertionSync(self, xml, opts);
+                    let res = await this.isValidXml(samlContent).catch((error) => {
+                        return Promise.reject('ERR_EXCEPTION_VALIDATE_XML');
+                    });
+                    if (res !== true) {
+                        return Promise.reject('ERR_EXCEPTION_VALIDATE_XML');
+                    }
                     samlContent = result[0];
                     assertionContent = result[1];
                     decrypted = true;
@@ -863,6 +718,7 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             status = (!isMessageSigned || MessageSignatureStatus) &&
                 (!isAssertionSigned || AssertionSignatureStatus) &&
                 (!encrypted || decrypted);
+            // 最终检测不安全的签名算法
             return {
                 isMessageSigned,
                 MessageSignatureStatus,
@@ -873,7 +729,9 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                 type, // 添加类型字段
                 status,
                 samlContent,
-                assertionContent
+                assertionContent,
+                hasUnsafeSignatureAlgorithm,
+                unsafeSignatureAlgorithm
             };
         },
         verifySignatureSoap(xml, opts) {
@@ -939,6 +797,8 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             for (const signatureNode of selection) {
                 const sig = new SignedXml();
                 let verified = false;
+                // 检测不安全的签名算法
+                const { hasUnsafeSignatureAlgorithm, unsafeSignatureAlgorithm } = checkUnsafeSignatureAlgorithm(opts.signatureAlgorithm || '');
                 sig.signatureAlgorithm = opts.signatureAlgorithm;
                 if (!opts.keyFile && !opts.metadata) {
                     throw new Error('ERR_UNDEFINED_SIGNATURE_VERIFIER_OPTIONS');
@@ -991,25 +851,25 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                         // @ts-expect-error
                         const assertions = select("./*[local-name()='Assertion']", rootNode);
                         if (encryptedAssert.length === 1) {
-                            return [true, encryptedAssert[0].toString(), true, false];
+                            return [true, encryptedAssert[0].toString(), true, false, hasUnsafeSignatureAlgorithm, unsafeSignatureAlgorithm];
                         }
                         if (assertions.length === 1) {
-                            return [true, assertions[0].toString(), false, false];
+                            return [true, assertions[0].toString(), false, false, hasUnsafeSignatureAlgorithm, unsafeSignatureAlgorithm];
                         }
-                        return [true, null, false, true]; // 签名验证成功但未找到断言
+                        return [true, null, false, true, hasUnsafeSignatureAlgorithm, unsafeSignatureAlgorithm]; // 签名验证成功但未找到断言
                     case 'Assertion':
-                        return [true, rootNode.toString(), false, false];
+                        return [true, rootNode.toString(), false, false, hasUnsafeSignatureAlgorithm, unsafeSignatureAlgorithm];
                     case 'EncryptedAssertion':
-                        return [true, rootNode.toString(), true, false];
+                        return [true, rootNode.toString(), true, false, hasUnsafeSignatureAlgorithm, unsafeSignatureAlgorithm];
                     case 'ArtifactResolve':
                     case 'ArtifactResponse':
                         // 提取SOAP消息内部的实际内容
-                        return [true, rootNode.toString(), false, false];
+                        return [true, rootNode.toString(), false, false, hasUnsafeSignatureAlgorithm, unsafeSignatureAlgorithm];
                     default:
-                        return [true, null, false, true]; // 签名验证成功但未找到可识别的内容
+                        return [true, null, false, true, hasUnsafeSignatureAlgorithm, unsafeSignatureAlgorithm]; // 签名验证成功但未找到可识别的内容
                 }
             }
-            return [false, null, encryptedAssertions.length > 0, false];
+            return [false, null, encryptedAssertions.length > 0, false, false, null];
         },
         /**
          * @desc Helper function to create the key section in metadata (abstraction for signing and encrypt use)
@@ -1239,6 +1099,8 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             if (!decryptedResult) {
                 throw new Error('ERR_UNDEFINED_DECRYPTED_ASSERTION');
             }
+            let hasUnsafeSignatureAlgorithm = false;
+            let unsafeSignatureAlgorithm = "";
             // 解密完成后，检查解密后的断言是否还有签名需要验证
             const decryptedAssertionDoc = dom.parseFromString(decryptedResult, 'application/xml');
             let AssertionSignatureStatus = false;
@@ -1248,6 +1110,11 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             if (assertionSignatureNode.length > 0 && opts) {
                 // 解密后的断言有签名，需要验证
                 const signatureNode = assertionSignatureNode[0];
+                // @ts-expect-error misssing Node properties are not needed
+                const signatureAlgorithm = xpath.select1(".//*[local-name(.)='SignatureMethod']/@Algorithm", signatureNode);
+                let checkResult = checkUnsafeSignatureAlgorithm(signatureAlgorithm.value || '');
+                hasUnsafeSignatureAlgorithm = checkResult.hasUnsafeSignatureAlgorithm;
+                unsafeSignatureAlgorithm = checkResult.unsafeSignatureAlgorithm ?? "";
                 const sig = new SignedXml();
                 if (!opts.keyFile && !opts.metadata) {
                     throw new Error('ERR_UNDEFINED_SIGNATURE_VERIFIER_OPTIONS');
@@ -1281,6 +1148,10 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                         sig.publicCert = this.getKeyInfo(metadataCert[0]).getKey();
                     }
                 }
+                // 检测不安全的签名算法
+                let checkSafeResult = checkUnsafeSignatureAlgorithm(opts.signatureAlgorithm || '');
+                hasUnsafeSignatureAlgorithm = checkSafeResult.hasUnsafeSignatureAlgorithm;
+                unsafeSignatureAlgorithm = checkSafeResult.unsafeSignatureAlgorithm ?? "";
                 sig.signatureAlgorithm = opts.signatureAlgorithm;
                 // @ts-expect-error misssing Node properties are not needed
                 sig.loadSignature(signatureNode);
@@ -1288,8 +1159,6 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
                 const assertionDocForVerification = dom.parseFromString(decryptedResult, 'application/xml');
                 const assertionValid = sig.checkSignature(assertionDocForVerification.toString());
                 AssertionSignatureStatus = assertionValid;
-                console.log(AssertionSignatureStatus);
-                console.log("验证通过了====");
                 if (!assertionValid) {
                     throw new Error('ERR_FAILED_TO_VERIFY_DECRYPTED_ASSERTION_SIGNATURE');
                 }
@@ -1300,7 +1169,9 @@ xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="{ID}"
             doc.documentElement.replaceChild(rawAssertionDoc.documentElement, encAssertionNode);
             return [doc.toString(), decryptedResult, {
                     isAssertionSigned: !!(assertionSignatureNode.length > 0 && opts),
-                    AssertionSignatureStatus: AssertionSignatureStatus
+                    AssertionSignatureStatus: AssertionSignatureStatus,
+                    hasUnsafeSignatureAlgorithm,
+                    unsafeSignatureAlgorithm
                 }];
         },
         /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "samlesa",
-  "version": "2.18.2",
+  "version": "2.18.4",
   "description": "High-level API for Single Sign On (SAML 2.0) baseed on samlify ",
   "main": "build/index.js",
   "keywords": [
@@ -43,35 +43,35 @@
   "license": "MIT",
   "dependencies": {
     "@xmldom/xmldom": "^0.9.8",
-    "axios": "^1.10.0",
-    "camelcase": "^8.0.0",
-    "cross-env": "^7.0.3",
-    "iconv-lite": "^0.6.3",
+    "axios": "^1.13.5",
+    "camelcase": "^9.0.0",
+    "cross-env": "^10.1.0",
+    "iconv-lite": "^0.7.2",
     "node-rsa": "^1.1.1",
     "pako": "^2.1.0",
     "ts-node": "^10.9.2",
-    "uuid": "^11.1.0",
-    "vite-tsconfig-paths": "^5.1.4",
+    "uuid": "^13.0.0",
+    "vite-tsconfig-paths": "^6.1.1",
     "xml": "^1.0.1",
     "xml-crypto": "^6.1.2",
     "xml-encryption": "^3.1.0",
     "xml-escape": "^1.1.0",
     "xml2js": "^0.6.2",
-    "xmllint-wasm": "^5.0.0",
+    "xmllint-wasm": "^5.1.0",
     "xpath": "^0.0.32"
   },
   "devDependencies": {
-    "@types/node": "^24.0.13",
-    "@types/pako": "2.0.3",
-    "@types/uuid": "10.0.0",
-    "@vitest/coverage-istanbul": "^3.2.4",
-    "@vitest/coverage-v8": "3.2.4",
+    "@types/node": "^25.3.2",
+    "@types/pako": "2.0.4",
+    "@types/uuid": "11.0.0",
+    "@vitest/coverage-istanbul": "^4.0.18",
+    "@vitest/coverage-v8": "4.0.18",
     "copyfiles": "^2.4.1",
     "coveralls": "^3.1.1",
-    "esbuild": "^0.25.6",
-    "jsdom": "^26.1.0",
+    "esbuild": "^0.27.3",
+    "jsdom": "^28.1.0",
     "timekeeper": "^2.3.1",
-    "typescript": "5.8.3",
-    "vitest": "^3.2.4"
+    "typescript": "5.9.3",
+    "vitest": "^4.0.18"
   }
 }

package/types/src/extractor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extractor.d.ts","sourceRoot":"","sources":["../../src/extractor.ts"],"names":[],"mappings":"AAKA,UAAU,cAAc;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;IACjC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,eAAe,GAAG,cAAc,EAAE,CAAC;AA4B/C,eAAO,MAAM,kBAAkB,EAAE,eA2BhC,CAAC;AACF,eAAO,MAAM,qBAAqB;;;;;;;;;;IAiBjC,CAAC;AACF,eAAO,MAAM,sBAAsB;;;;;;;;;;IAiBlC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;GAWrC,CAAC;AAEF,eAAO,MAAM,iCAAiC;;;;GAW7C,CAAC;AAGF,eAAO,MAAM,0BAA0B;;;;GAWtC,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,KAAK,eAAe,CAiDrE,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,eA2BjC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,eAiBlC,CAAC;AAEF,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,KAAA,OA6M9C"}
+{"version":3,"file":"extractor.d.ts","sourceRoot":"","sources":["../../src/extractor.ts"],"names":[],"mappings":"AAKA,UAAU,cAAc;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;IACjC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,eAAe,GAAG,cAAc,EAAE,CAAC;AA4B/C,eAAO,MAAM,kBAAkB,EAAE,eA2BhC,CAAC;AACF,eAAO,MAAM,qBAAqB;;;;;;;;;;IAiBjC,CAAC;AACF,eAAO,MAAM,sBAAsB;;;;;;;;;;IAiBlC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;GAWrC,CAAC;AAEF,eAAO,MAAM,iCAAiC;;;;GAW7C,CAAC;AAGF,eAAO,MAAM,0BAA0B;;;;GAWtC,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,KAAK,eAAe,CAkErE,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,eA2BjC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,eAiBlC,CAAC;AAEF,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,KAAA,OA6M9C"}

package/types/src/flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../src/flow.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,UAAU;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,GAAG,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAgsBD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CA6BhG;AAED,wBAAgB,IAAI,CAAC,OAAO,KAAA,GAAG,OAAO,CAAC,UAAU,CAAC,CA0BjD"}
+{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../src/flow.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,UAAU;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,GAAG,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAitBD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BhG;AAED,wBAAgB,IAAI,CAAC,OAAO,KAAA,GAAG,OAAO,CAAC,UAAU,CAAC,CA0BjD"}

package/types/src/libsaml.d.ts

@@ -136,6 +136,10 @@ declare const _default: {
         xml: string;
         error: null;
     };
+    checkUnsafeSignatureAlgorithm: (signatureAlgorithm: string) => {
+        hasUnsafeSignatureAlgorithm: boolean;
+        unsafeSignatureAlgorithm: string | null;
+    };
     /**
      * @desc Replace the tag (e.g. {tag}) inside the raw XML
      * @param  {string} rawXML      raw XML string used to do keyword replacement
@@ -156,7 +160,7 @@ declare const _default: {
      * @desc Construct the XML signature for POST binding
      * @param  {string} rawSamlMessage      request/response xml string
      * @param  {string} referenceTagXPath    reference uri
-     * @param  {string} privateKey           declares the private key
+     * @param  {string} privateKey           declares the private key-
      * @param  {string} passphrase           passphrase of the private key [optional]
      * @param  {string|buffer} signingCert   signing certificate
      * @param  {string} signatureAlgorithm   signature algorithm
@@ -168,7 +172,7 @@ declare const _default: {
         isValid: boolean;
         subject: string;
         issuer: string;
-        publicKey: import("crypto").KeyObject;
+        publicKey: import("node:crypto").KeyObject;
         error?: undefined;
     } | {
         isValid: boolean;
@@ -177,15 +181,6 @@ declare const _default: {
         issuer?: undefined;
         publicKey?: undefined;
     };
-    /**
-     * @desc Verify the XML signature
-     * @param  {string} xml xml
-     * @param  {SignatureVerifierOptions} opts cert declares the X509 certificate
-     * @return {[boolean, string | null]} - A tuple where:
-     *   - The first element is `true` if the signature is valid, `false` otherwise.
-     *   - The second element is the cryptographically authenticated assertion node as a string, or `null` if not found.
-     */
-    verifySignature1(xml: string, opts: SignatureVerifierOptions): (boolean | null)[] | (string | boolean)[];
     /**
      * 改进的SAML签名验证函数，支持多种签名和加密组合场景
      * @param xml SAML XML内容
@@ -193,14 +188,7 @@ declare const _default: {
      * @param self
      * @returns 验证结果对象
      */
-    /**
-     * 改进的SAML签名验证函数，支持多种签名和加密组合场景
-     * @param xml SAML XML内容
-     * @param opts 验证选项
-     * @param self
-     * @returns 验证结果对象
-     */
-    verifySignature(xml: string, opts: SignatureVerifierOptions, self: any): {
+    verifySignature(xml: string, opts: SignatureVerifierOptions, self: any): Promise<{
         isMessageSigned: boolean;
         MessageSignatureStatus: boolean;
         isAssertionSigned: boolean;
@@ -211,8 +199,10 @@ declare const _default: {
         status: boolean;
         samlContent: string;
         assertionContent: null;
-    };
-    verifySignatureSoap(xml: string, opts: SignatureVerifierOptions): (boolean | null)[] | (string | boolean)[];
+        hasUnsafeSignatureAlgorithm: boolean;
+        unsafeSignatureAlgorithm: string;
+    }>;
+    verifySignatureSoap(xml: string, opts: SignatureVerifierOptions): (string | boolean | null)[];
     /**
      * @desc Helper function to create the key section in metadata (abstraction for signing and encrypt use)
      * @param  {string} use          type of certificate (e.g. signing, encrypt)
@@ -274,6 +264,8 @@ declare const _default: {
     decryptAssertionSync(here: any, entireXML: string, opts?: SignatureVerifierOptions): (string | {
         isAssertionSigned: boolean;
         AssertionSignatureStatus: boolean;
+        hasUnsafeSignatureAlgorithm: boolean;
+        unsafeSignatureAlgorithm: string;
     })[];
     /**
      * 解密 SOAP 响应中的加密断言

package/types/src/libsaml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"libsaml.d.ts","sourceRoot":"","sources":["../../src/libsaml.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,eAAe,CAAC;AAerD;;;;GAIG;AAGH,MAAM,WAAW,oBAAoB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,GAAG,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,wBAAwB;IACrC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IAEnB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,gCAAgC;IAC7C,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACxD,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC7B,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC3D,UAAU,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACtC,mBAAmB,CAAC,EAAE,gCAAgC,CAAC;CAC1D;AAED,MAAM,WAAW,0BAA2B,SAAQ,gBAAgB;CACnE;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;CAC1D;AAED,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;CAC7D;AAED,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;CAC9D;AAED,MAAM,WAAW,sBAAuB,SAAQ,gBAAgB;CAC/D;AAED,MAAM,MAAM,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAE9C,MAAM,WAAW,YAAY;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC7B,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9C,WAAW,EAAE,CAAC,KAAK,KAAA,EAAE,YAAY,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IACvD,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,MAAM,CAAC;IAC/D,yBAAyB,EAAE,CAAC,UAAU,EAAE,sBAAsB,EAAE,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,0BAA0B,KAAK,MAAM,CAAC;IAC1K,sBAAsB,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,MAAM,CAAC;IAC/D,eAAe,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjF,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC;IAC7D,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAE5I,sBAAsB,EAAE,CAAC,QAAQ,KAAA,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACzH,UAAU,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC;IACrE,gBAAgB,EAAE,CAAC,YAAY,KAAA,EAAE,YAAY,KAAA,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrF,gBAAgB,EAAE,CAAC,IAAI,KAAA,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAEtE,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACpD,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAEnD,gBAAgB,EAAE,GAAG,CAAC;IACtB,2BAA2B,EAAE,oBAAoB,CAAC;IAClD,4BAA4B,EAAE,qBAAqB,CAAC;IACpD,iCAAiC,EAAE,0BAA0B,CAAC;IAC9D,wBAAwB,EAAE,iBAAiB,CAAC;IAC5C,4BAA4B,EAAE,qBAAqB,CAAC;IACpD,6BAA6B,EAAE,sBAAsB,CAAC;CACzD;;6CA2L8C,OAAO,KAAG,MAAM;gCAnLxB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA8NrC;;;;;OAKG;+BACwB,MAAM,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;IAS9E;;;;;;OAMG;IACH,eAAe;6CAC0B,GAAG,EAAE,GAAG,MAAM;IA0CvD;;;;;;;;;;OAUG;iCAC0B,oBAAoB;2CAiDV,MAAM,mBAAmB,MAAM;;;;;;;;;;;;;IAiCtE;;;;;;;OAOG;0BAEmB,MAAM,QAAQ,wBAAwB;IA0M5D;;;;;;OAMG;IAGH;;;;;;OAMG;yBACkB,MAAM,QAAQ,wBAAwB,QAAQ,GAAG;;;;;;;;;;;;6BAsV7C,MAAM,QAAQ,wBAAwB;IAkK/D;;;;;OAKG;0BACmB,MAAM,cAAc,MAAM,GAAG,MAAM,GAAG,YAAY;IAsBxE;;;;;;;;OAQG;2CAEc,MAAM,OACd,MAAM,eACE,MAAM,aACR,OAAO,qBACC,MAAM;IA8B7B;;;;;;;OAOG;uDAGc,MAAM,aACR,MAAM,GAAG,MAAM,oBACR,MAAM;IAO5B;;;;OAIG;gCACyB,MAAM,oBAAmB,GAAG;;;;IAWxD;;;;;;OAMG;iEAEgD,MAAM;IAsDzD;;;;;;;OAOG;2CAC+B,MAAM;IAoCxC;;OAEG;IACH;;OAEG;+CACmC,MAAM,SAAS,wBAAwB;;;;IA4G7E;;;;;OAKG;+BAC8B,GAAG,aAAa,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAuEnF;;OAEG;sBACqB,MAAM,SAAQ,OAAO;;AA8BrD,wBAAyB"}
+{"version":3,"file":"libsaml.d.ts","sourceRoot":"","sources":["../../src/libsaml.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,eAAe,CAAC;AAerD;;;;GAIG;AAGH,MAAM,WAAW,oBAAoB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,GAAG,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,wBAAwB;IACrC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IAEnB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,gCAAgC;IAC7C,0BAA0B,CAAC,EAAE,0BAA0B,CAAC;IACxD,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC7B,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC3D,UAAU,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACtC,mBAAmB,CAAC,EAAE,gCAAgC,CAAC;CAC1D;AAED,MAAM,WAAW,0BAA2B,SAAQ,gBAAgB;CACnE;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;CAC1D;AAED,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;CAC7D;AAED,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;CAC9D;AAED,MAAM,WAAW,sBAAuB,SAAQ,gBAAgB;CAC/D;AAED,MAAM,MAAM,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAE9C,MAAM,WAAW,YAAY;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC7B,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9C,WAAW,EAAE,CAAC,KAAK,KAAA,EAAE,YAAY,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IACvD,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,MAAM,CAAC;IAC/D,yBAAyB,EAAE,CAAC,UAAU,EAAE,sBAAsB,EAAE,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,0BAA0B,KAAK,MAAM,CAAC;IAC1K,sBAAsB,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,MAAM,CAAC;IAC/D,eAAe,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACjF,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC;IAC7D,yBAAyB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAE5I,sBAAsB,EAAE,CAAC,QAAQ,KAAA,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACzH,UAAU,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC;IACrE,gBAAgB,EAAE,CAAC,YAAY,KAAA,EAAE,YAAY,KAAA,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrF,gBAAgB,EAAE,CAAC,IAAI,KAAA,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAEtE,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACpD,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAEnD,gBAAgB,EAAE,GAAG,CAAC;IACtB,2BAA2B,EAAE,oBAAoB,CAAC;IAClD,4BAA4B,EAAE,qBAAqB,CAAC;IACpD,iCAAiC,EAAE,0BAA0B,CAAC;IAC9D,wBAAwB,EAAE,iBAAiB,CAAC;IAC5C,4BAA4B,EAAE,qBAAqB,CAAC;IACpD,6BAA6B,EAAE,sBAAsB,CAAC;CACzD;;6CAoN8C,OAAO,KAAG,MAAM;gCA5MxB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDA8BkB,MAAM;;;;IA0N7D;;;;;OAKG;+BACwB,MAAM,aAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;IAS9E;;;;;;OAMG;IACH,eAAe;6CAC0B,GAAG,EAAE,GAAG,MAAM;IA0CvD;;;;;;;;;;OAUG;iCAC0B,oBAAoB;2CAiDV,MAAM,mBAAmB,MAAM;;;;;;;;;;;;;IAoCtE;;;;;;OAMG;yBACwB,MAAM,QAAQ,wBAAwB,QAAQ,GAAG;;;;;;;;;;;;;;6BA6XnD,MAAM,QAAQ,wBAAwB;IAoK/D;;;;;OAKG;0BACmB,MAAM,cAAc,MAAM,GAAG,MAAM,GAAG,YAAY;IAsBxE;;;;;;;;OAQG;2CAEc,MAAM,OACd,MAAM,eACE,MAAM,aACR,OAAO,qBACC,MAAM;IA8B7B;;;;;;;OAOG;uDAGc,MAAM,aACR,MAAM,GAAG,MAAM,oBACR,MAAM;IAO5B;;;;OAIG;gCACyB,MAAM,oBAAmB,GAAG;;;;IAWxD;;;;;;OAMG;iEAEgD,MAAM;IAsDzD;;;;;;;OAOG;2CAC+B,MAAM;IAoCxC;;OAEG;IACH;;OAEG;+CACmC,MAAM,SAAS,wBAAwB;;;;;;IAsH7E;;;;;OAKG;+BAC8B,GAAG,aAAa,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAuEnF;;OAEG;sBACqB,MAAM,SAAQ,OAAO;;AA8BrD,wBAAyB"}

package/types/src/utility.d.ts

@@ -101,7 +101,7 @@ declare function applyDefault(obj1: any, obj2: any): any;
  * @param {string} x509 certificate
  * @return {string} public key fetched from the certificate
  */
-declare function getPublicKeyPemFromCertificate(x509CertificateString: string): string | Buffer<ArrayBufferLike>;
+declare function getPublicKeyPemFromCertificate(x509CertificateString: string): string;
 export declare function readPrivateKey(keyString: string | Buffer, passphrase?: string, isOutputString?: boolean): string | Buffer;
 /**
  * @desc Inline syntax sugar

package/types/src/utility.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utility.d.ts","sourceRoot":"","sources":["../../src/utility.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,cAAc,UAAO,MAmB3E;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,OAIvC;AAED;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAEhC;AAED;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,YAGnC;AAED;;;;;;GAMG;AACH,wBAAgB,GAAG,CAAC,GAAG,KAAA,EAAE,IAAI,KAAA,EAAE,YAAY,KAAA,OAG1C;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,GAAG,mBAElC;AAED;;;;GAIG;AACH,iBAAS,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,UAE/C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAGtF;AAED;;;;GAIG;AACH,iBAAS,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAIhD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAa9D;AAYD;;;;GAIG;AACH,iBAAS,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,UAEtD;AAED;;;;GAIG;AACH,iBAAS,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,UAErD;AAED;;;;GAIG;AACH,iBAAS,UAAU,CAAC,GAAG,KAAA,UAEtB;AAED;;;;GAIG;AACH,iBAAS,WAAW,CAAC,GAAG,KAAA,EAAE,YAAY,SAAK,OAE1C;AAED;;;;;GAKG;AACH,iBAAS,YAAY,CAAC,IAAI,KAAA,EAAE,IAAI,KAAA,OAE/B;AAED;;;;GAIG;AACH,iBAAS,8BAA8B,CAAC,qBAAqB,EAAE,MAAM,oCAWpE;AAqCD,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,GAAG,MAAM,EAC1B,UAAU,CAAC,EAAE,MAAM,EACnB,cAAc,GAAE,OAAc,GAC7B,MAAM,GAAG,MAAM,CA4BjB;AAGD;;GAEG;AACH,iBAAS,eAAe,CAAC,KAAK,KAAA,EAAE,cAAc,KAAA,OAE7C;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,GAAG,WAErC;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,CAGhD;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM,CAElF;AAED,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;CAeZ,CAAC;AAEF,eAAe,OAAO,CAAC"}
+{"version":3,"file":"utility.d.ts","sourceRoot":"","sources":["../../src/utility.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,cAAc,UAAO,MAmB3E;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,OAIvC;AAED;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAEhC;AAED;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,YAGnC;AAED;;;;;;GAMG;AACH,wBAAgB,GAAG,CAAC,GAAG,KAAA,EAAE,IAAI,KAAA,EAAE,YAAY,KAAA,OAG1C;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,GAAG,mBAElC;AAED;;;;GAIG;AACH,iBAAS,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,UAE/C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAGtF;AAED;;;;GAIG;AACH,iBAAS,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAIhD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAa9D;AAYD;;;;GAIG;AACH,iBAAS,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,UAEtD;AAED;;;;GAIG;AACH,iBAAS,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,UAErD;AAED;;;;GAIG;AACH,iBAAS,UAAU,CAAC,GAAG,KAAA,UAEtB;AAED;;;;GAIG;AACH,iBAAS,WAAW,CAAC,GAAG,KAAA,EAAE,YAAY,SAAK,OAE1C;AAED;;;;;GAKG;AACH,iBAAS,YAAY,CAAC,IAAI,KAAA,EAAE,IAAI,KAAA,OAE/B;AAED;;;;GAIG;AACH,iBAAS,8BAA8B,CAAC,qBAAqB,EAAE,MAAM,UAWpE;AAqCD,wBAAgB,cAAc,CAC5B,SAAS,EAAE,MAAM,GAAG,MAAM,EAC1B,UAAU,CAAC,EAAE,MAAM,EACnB,cAAc,GAAE,OAAc,GAC7B,MAAM,GAAG,MAAM,CA4BjB;AAGD;;GAEG;AACH,iBAAS,eAAe,CAAC,KAAK,KAAA,EAAE,cAAc,KAAA,OAE7C;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,GAAG,WAErC;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,CAGhD;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM,CAElF;AAED,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;CAeZ,CAAC;AAEF,eAAe,OAAO,CAAC"}