samlesa 4.3.5 → 4.5.0

package/build/src/flow.js

@@ -24,6 +24,154 @@ function getDefaultExtractorFields(parserType, assertion) {
             throw new Error('ERR_UNDEFINED_PARSERTYPE');
     }
 }
+function collectServiceLocations(entityMeta, serviceKey) {
+    const serviceConfig = entityMeta?.meta?.[serviceKey];
+    if (!serviceConfig) {
+        return [];
+    }
+    const collectFromEntry = (entry) => {
+        if (!entry) {
+            return [];
+        }
+        if (typeof entry === 'string') {
+            return entry.trim() ? [entry.trim()] : [];
+        }
+        if (typeof entry !== 'object') {
+            return [];
+        }
+        const directLocation = entry.location ?? entry.Location;
+        if (typeof directLocation === 'string' && directLocation.trim()) {
+            return [directLocation.trim()];
+        }
+        return Object.values(entry)
+            .filter((value) => typeof value === 'string' && value.trim().length > 0)
+            .map(value => value.trim())
+            .filter(value => /^https?:/i.test(value));
+    };
+    if (Array.isArray(serviceConfig)) {
+        return serviceConfig.flatMap(collectFromEntry);
+    }
+    if (typeof serviceConfig === 'object') {
+        const directLocations = collectFromEntry(serviceConfig);
+        if (directLocations.length > 0) {
+            return directLocations;
+        }
+        return Object.values(serviceConfig).flatMap(collectFromEntry);
+    }
+    return collectFromEntry(serviceConfig);
+}
+function matchesKnownEndpoint(endpoint, knownEndpoints) {
+    return typeof endpoint === 'string' && endpoint.length > 0 && knownEndpoints.includes(endpoint);
+}
+function validateIssuer(parserType, extractedProperties, expectedIssuer) {
+    const messageIssuer = extractedProperties?.issuer;
+    if (parserType === ParserType.SAMLResponse) {
+        const responseIssuer = extractedProperties?.responseIssuer;
+        if (responseIssuer && responseIssuer !== expectedIssuer) {
+            return 'ERR_UNMATCH_ISSUER';
+        }
+        if (messageIssuer && messageIssuer !== expectedIssuer) {
+            return 'ERR_UNMATCH_ISSUER';
+        }
+        if (responseIssuer && messageIssuer && responseIssuer !== messageIssuer) {
+            return 'ERR_UNMATCH_ISSUER';
+        }
+        return null;
+    }
+    if (messageIssuer && messageIssuer !== expectedIssuer) {
+        return 'ERR_UNMATCH_ISSUER';
+    }
+    return null;
+}
+function validateResponseTimes(parserType, extractedProperties, self) {
+    if (parserType !== ParserType.SAMLResponse) {
+        return null;
+    }
+    if (extractedProperties?.sessionIndex?.sessionNotOnOrAfter &&
+        !verifyTime(undefined, extractedProperties.sessionIndex.sessionNotOnOrAfter, self.entitySetting.clockDrifts)) {
+        return 'ERR_EXPIRED_SESSION';
+    }
+    if (extractedProperties?.conditions &&
+        !verifyTime(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) {
+        return 'ERR_CONDITION_UNCONFIRMED';
+    }
+    if (extractedProperties?.subjectConfirmation?.notOnOrAfter &&
+        !verifyTime(undefined, extractedProperties.subjectConfirmation.notOnOrAfter, self.entitySetting.clockDrifts)) {
+        return 'ERR_SUBJECT_UNCONFIRMED';
+    }
+    return null;
+}
+function validateEndpointConstraints(parserType, extractedProperties, self, from) {
+    const requestData = extractedProperties?.request ?? {};
+    const responseData = extractedProperties?.response ?? {};
+    const subjectConfirmation = extractedProperties?.subjectConfirmation ?? {};
+    switch (parserType) {
+        case ParserType.SAMLRequest: {
+            const validSsoUrls = collectServiceLocations(self?.entityMeta, 'singleSignOnService');
+            if (requestData.destination &&
+                validSsoUrls.length > 0 &&
+                !matchesKnownEndpoint(requestData.destination, validSsoUrls)) {
+                return 'ERR_INVALID_DESTINATION';
+            }
+            const assertionConsumerServiceUrl = requestData.assertionConsumerServiceUrl ??
+                requestData.assertionConsumerServiceURL;
+            const validAcsUrls = collectServiceLocations(from?.entityMeta, 'assertionConsumerService');
+            if (assertionConsumerServiceUrl &&
+                validAcsUrls.length > 0 &&
+                !matchesKnownEndpoint(assertionConsumerServiceUrl, validAcsUrls)) {
+                return 'ERR_INVALID_ASSERTION_CONSUMER_SERVICE';
+            }
+            return null;
+        }
+        case ParserType.SAMLResponse: {
+            const validAcsUrls = collectServiceLocations(self?.entityMeta, 'assertionConsumerService');
+            if (validAcsUrls.length === 0) {
+                return null;
+            }
+            if (!matchesKnownEndpoint(responseData.destination, validAcsUrls)) {
+                return 'ERR_INVALID_DESTINATION';
+            }
+            if (!matchesKnownEndpoint(subjectConfirmation.recipient, validAcsUrls)) {
+                return 'ERR_INVALID_RECIPIENT';
+            }
+            if (responseData.destination !== subjectConfirmation.recipient) {
+                return 'ERR_DESTINATION_RECIPIENT_MISMATCH';
+            }
+            if (responseData.inResponseTo &&
+                subjectConfirmation.inResponseTo &&
+                responseData.inResponseTo !== subjectConfirmation.inResponseTo) {
+                return 'ERR_UNMATCH_IN_RESPONSE_TO';
+            }
+            return null;
+        }
+        case ParserType.LogoutRequest:
+        case ParserType.LogoutResponse: {
+            const validSloUrls = collectServiceLocations(self?.entityMeta, 'singleLogoutService');
+            const destination = parserType === ParserType.LogoutRequest
+                ? requestData.destination
+                : responseData.destination;
+            if (destination &&
+                validSloUrls.length > 0 &&
+                !matchesKnownEndpoint(destination, validSloUrls)) {
+                return 'ERR_INVALID_LOGOUT_DESTINATION';
+            }
+            return null;
+        }
+        default:
+            return null;
+    }
+}
+function runCommonValidation(parserType, extractedProperties, self, from) {
+    const issuerError = validateIssuer(parserType, extractedProperties, from.entityMeta.getEntityID());
+    if (issuerError) {
+        return issuerError;
+    }
+    const timeError = validateResponseTimes(parserType, extractedProperties, self);
+    if (timeError) {
+        return timeError;
+    }
+    return validateEndpointConstraints(parserType, extractedProperties, self, from);
+}
 // proceed the redirect binding flow
 async function redirectFlow(options) {
     const { request, parserType, self, checkSignature = true, from } = options;
@@ -87,39 +235,12 @@ async function redirectFlow(options) {
         }
         parseResult.sigAlg = decodeSigAlg;
     }
-    /**
-     *  Validation part: validate the context of response after signature is verified and decrypted (optional)
-     */
-    const issuer = targetEntityMetadata.getEntityID();
-    const extractedProperties = parseResult.extract;
-    // unmatched issuer
-    if ((parserType === 'LogoutResponse' || parserType === 'SAMLResponse')
-        && extractedProperties
-        && extractedProperties.issuer !== issuer) {
-        return Promise.reject('ERR_UNMATCH_ISSUER');
-    }
-    // invalid session time
-    // only run the verifyTime when `SessionNotOnOrAfter` exists
-    if (parserType === 'SAMLResponse'
-        && extractedProperties.sessionIndex.sessionNotOnOrAfter
-        && !verifyTime(undefined, extractedProperties.sessionIndex.sessionNotOnOrAfter, self.entitySetting.clockDrifts)) {
-        return Promise.reject('ERR_EXPIRED_SESSION');
-    }
-    // invalid time
-    // 2.4.1.2 https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
-    if (parserType === 'SAMLResponse'
-        && extractedProperties.conditions
-        && !verifyTime(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) {
-        return Promise.reject('ERR_CONDITION_UNCONFIRMED');
-    }
-    if (parserType === 'SAMLResponse') {
-        let destination = extractedProperties?.response?.destination;
-        let isExit = self.entitySetting?.assertionConsumerService?.filter((item) => {
-            return item?.location === destination;
-        });
-        if (isExit?.length === 0) {
+    const validationError = runCommonValidation(parserType, parseResult.extract, self, from);
+    if (validationError) {
+        if (validationError === 'ERR_INVALID_DESTINATION') {
             return Promise.reject('ERR_Destination_URL');
         }
+        return Promise.reject(validationError);
     }
     return Promise.resolve(parseResult);
 }
@@ -170,25 +291,35 @@ async function postFlow(options) {
     };
     // 检查验证结果
     if (!verificationResult.status) {
-        // 如果验证失败，根据具体情况返回错误
-        /** 需要判断是不是  */
-        if (verificationResult.isMessageSigned && !verificationResult.MessageSignatureStatus) {
-            return Promise.reject('ERR_FAIL_TO_VERIFY_MESSAGE_SIGNATURE');
-        }
-        if (verificationResult.isAssertionSigned && !verificationResult.AssertionSignatureStatus) {
-            return Promise.reject('ERR_FAIL_TO_VERIFY_ASSERTION_SIGNATURE');
-        }
-        if (verificationResult.encrypted && !verificationResult.decrypted) {
-            return Promise.reject('ERR_FAIL_TO_DECRYPT_ASSERTION');
+        if (!checkSignature &&
+            parserType === urlParams.samlRequest &&
+            !verificationResult.isMessageSigned &&
+            !verificationResult.isAssertionSigned &&
+            !verificationResult.encrypted) {
+            verificationResult.status = true;
+            verificationResult.samlContent = samlContent;
         }
-        if (!verificationResult.isMessageSigned && verificationResult.type === 'LogoutRequest') {
-            return Promise.reject('ERR_LogoutRequest_Need_Signature');
-        }
-        if (!verificationResult.isMessageSigned && verificationResult.type === 'LogoutResponse') {
-            return Promise.reject('ERR_LogoutResponse_Need_Signature');
+        else {
+            // 如果验证失败，根据具体情况返回错误
+            /** 需要判断是不是  */
+            if (verificationResult.isMessageSigned && !verificationResult.MessageSignatureStatus) {
+                return Promise.reject('ERR_FAIL_TO_VERIFY_MESSAGE_SIGNATURE');
+            }
+            if (verificationResult.isAssertionSigned && !verificationResult.AssertionSignatureStatus) {
+                return Promise.reject('ERR_FAIL_TO_VERIFY_ASSERTION_SIGNATURE');
+            }
+            if (verificationResult.encrypted && !verificationResult.decrypted) {
+                return Promise.reject('ERR_FAIL_TO_DECRYPT_ASSERTION');
+            }
+            if (!verificationResult.isMessageSigned && verificationResult.type === 'LogoutRequest') {
+                return Promise.reject('ERR_LogoutRequest_Need_Signature');
+            }
+            if (!verificationResult.isMessageSigned && verificationResult.type === 'LogoutResponse') {
+                return Promise.reject('ERR_LogoutResponse_Need_Signature');
+            }
+            // 通用验证失败
+            return Promise.reject('ERR_FAIL_TO_VERIFY_SIGNATURE_OR_DECRYPTION');
         }
-        // 通用验证失败
-        return Promise.reject('ERR_FAIL_TO_VERIFY_SIGNATURE_OR_DECRYPTION');
     }
     // 更新samlContent为验证后的版本（可能已解密）
     samlContent = verificationResult.samlContent;
@@ -204,121 +335,9 @@ async function postFlow(options) {
         samlContent: samlContent,
         extract: extract(samlContent, extractorFields),
     };
-    /**
-     *  Validation part: validate the context of response after signature is verified and decrypted (optional)
-     */
-    const targetEntityMetadata = from.entityMeta;
-    const issuer = targetEntityMetadata.getEntityID();
-    const extractedProperties = parseResult.extract;
-    // unmatched issuer
-    if ((parserType === 'LogoutResponse' || parserType === 'SAMLResponse')
-        && extractedProperties
-        && extractedProperties.issuer !== issuer) {
-        return Promise.reject('ERR_UNMATCH_ISSUER');
-    }
-    // invalid session time
-    // only run the verifyTime when `SessionNotOnOrAfter` exists
-    if (parserType === 'SAMLResponse'
-        && extractedProperties.sessionIndex.sessionNotOnOrAfter
-        && !verifyTime(undefined, extractedProperties.sessionIndex.sessionNotOnOrAfter, self.entitySetting.clockDrifts)) {
-        return Promise.reject('ERR_EXPIRED_SESSION');
-    }
-    // invalid time
-    // 2.4.1.2 https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
-    if (parserType === 'SAMLResponse'
-        && extractedProperties.conditions
-        && !verifyTime(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) {
-        return Promise.reject('ERR_CONDITION_UNCONFIRMED');
-    }
-    // invalid subjectConfirmation time
-    // invalid time
-    // 2.4.1.2 https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
-    if (parserType === 'SAMLResponse'
-        && extractedProperties.subjectConfirmation
-        && !verifyTime(undefined, extractedProperties.subjectConfirmation.notOnOrAfter, self.entitySetting.clockDrifts)) {
-        return Promise.reject('ERR_SUBJECT_UNCONFIRMED');
-    }
-    // ============================
-    // VALIDATE Destination & Recipient
-    // ============================
-    const { type } = verificationResult;
-    const { response, subjectConfirmation } = extractedProperties || {};
-    // 获取 SP 配置的所有合法 ACS URLs（用于比对）
-    const validACSUrls = (self?.entityMeta?.meta?.assertionConsumerService || [])
-        .map((item) => item.location)
-        .filter(Boolean);
-    /**
-     * Helper: Check if a given URL is in the list of valid ACS endpoints
-     */
-    function isValidACSEndpoint(url) {
-        return url != null && validACSUrls.includes(url);
-    }
-    // 根据消息类型执行不同的验证
-    switch (type) {
-        case 'Response': // SAML Response (Login)
-            {
-                // 1. 验证协议层 Destination（必须匹配 ACS）
-                const destination = response?.destination;
-                if (!isValidACSEndpoint(destination)) {
-                    return Promise.reject('ERR_INVALID_DESTINATION');
-                }
-                // 2. 验证断言层 Recipient（必须匹配 ACS，且通常应等于 Destination）
-                const recipient = subjectConfirmation?.recipient;
-                if (!isValidACSEndpoint(recipient)) {
-                    return Promise.reject('ERR_INVALID_RECIPIENT');
-                }
-                // 可选：强制 Destination === Recipient（推荐）
-                if (destination !== recipient) {
-                    // 注意：某些 IdP 可能不严格一致，但安全起见建议开启
-                    return Promise.reject('ERR_DESTINATION_RECIPIENT_MISMATCH');
-                }
-            }
-            break;
-        case 'LogoutRequest': // IdP 发起的单点登出
-            {
-                // LogoutRequest 是 IdP → SP，SP 是接收方
-                // 必须验证 Destination 是否为 SP 的 SLO endpoint（Single Logout Service）
-                const destination = response?.destination; // 注意：LogoutRequest 的 root 元素是 <samlp:LogoutRequest>
-                /** 必须检查是否为对象*/
-                let singleLogoutService = [];
-                if (self?.entityMeta?.meta?.singleLogoutService?.binding) {
-                    // @ts-ignore
-                    singleLogoutService = [self?.entityMeta?.meta?.singleLogoutService];
-                }
-                else {
-                    singleLogoutService = self?.entityMeta?.meta?.singleLogoutService;
-                }
-                const validSLOUrls = singleLogoutService
-                    .map((item) => item.location)
-                    .filter(Boolean);
-                if (destination && !validSLOUrls.includes(destination)) {
-                    return Promise.reject('ERR_INVALID_LOGOUT_DESTINATION');
-                }
-                // LogoutRequest 通常**不包含 Assertion**，所以无 Recipient
-                // 如果有嵌套断言（罕见），可额外处理，但一般不需要
-            }
-            break;
-        case 'LogoutResponse': // SP → IdP 的登出响应
-            {
-                // LogoutResponse 是 SP → IdP，IdP 是接收方
-                // 此时 SP 是发送方，**不应验证 Destination 是否属于自身**
-                // 而应由 IdP 验证。因此 SP 端通常**跳过 Destination 验证**
-                // 但如果你作为 SP 也要校验（比如防止发错），可对比 IdP 的 SLO URL
-                // —— 但你的 entityMeta 是 SP 自身，没有 IdP 的 SLO，所以一般不验
-                // ✅ 所以：LogoutResponse 在 SP 端通常**无需验证 Destination/Recipient**
-            }
-            break;
-        case 'AuthnRequest': // SP → IdP 的认证请求
-            {
-                // AuthnRequest 是 SP 发出的，不是接收的
-                // 此验证逻辑运行在 SP 接收响应时，**不会收到 AuthnRequest**
-                // 所以这个 case 实际不会触发，保留仅为完整性
-            }
-            break;
-        case 'Unknown':
-        default:
-            // 未知类型，保守拒绝
-            return Promise.reject('ERR_UNKNOWN_SAML_MESSAGE_TYPE');
+    const validationError = runCommonValidation(parserType, parseResult.extract, self, from);
+    if (validationError) {
+        return Promise.reject(validationError);
     }
     return Promise.resolve({
         ...parseResult,
@@ -389,44 +408,12 @@ async function postArtifactFlow(options) {
         samlContent: samlContent,
         extract: extract(samlContent, extractorFields),
     };
-    /**
-     *  Validation part: validate the context of response after signature is verified and decrypted (optional)
-     */
-    const targetEntityMetadata = from.entityMeta;
-    const issuer = targetEntityMetadata.getEntityID();
-    const extractedProperties = parseResult.extract;
-    // unmatched issuer
-    if ((parserType === 'LogoutResponse' || parserType === 'SAMLResponse')
-        && extractedProperties
-        && extractedProperties.issuer !== issuer) {
-        return Promise.reject('ERR_UNMATCH_ISSUER');
-    }
-    // invalid session time
-    // only run the verifyTime when `SessionNotOnOrAfter` exists
-    if (parserType === 'SAMLResponse'
-        && extractedProperties.sessionIndex.sessionNotOnOrAfter
-        && !verifyTime(undefined, extractedProperties.sessionIndex.sessionNotOnOrAfter, self.entitySetting.clockDrifts)) {
-        return Promise.reject('ERR_EXPIRED_SESSION');
-    }
-    // invalid time
-    // 2.4.1.2 https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
-    if (parserType === 'SAMLResponse'
-        && extractedProperties.conditions
-        && !verifyTime(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) {
-        return Promise.reject('ERR_CONDITION_UNCONFIRMED');
-    }
-    //valid destination
-    //There is no validation of the response here. The upper-layer application
-    // should verify the result by itself to see if the destination is equal to the SP acs and
-    // whether the response.id is used to prevent replay attacks.
-    if (parserType === 'SAMLResponse') {
-        let destination = extractedProperties?.response?.destination;
-        let isExit = self?.entityMeta?.meta?.assertionConsumerService?.filter((item) => {
-            return item?.location === destination;
-        });
-        if (isExit?.length === 0) {
+    const validationError = runCommonValidation(parserType, parseResult.extract, self, from);
+    if (validationError) {
+        if (validationError === 'ERR_INVALID_DESTINATION') {
             return Promise.reject('ERR_Destination_URL');
         }
+        return Promise.reject(validationError);
     }
     return Promise.resolve(parseResult);
 }
@@ -491,39 +478,12 @@ async function postSimpleSignFlow(options) {
         }
         parseResult.sigAlg = sigAlg;
     }
-    /**
-     *  Validation part: validate the context of response after signature is verified and decrypted (optional)
-     */
-    const issuer = targetEntityMetadata.getEntityID();
-    const extractedProperties = parseResult.extract;
-    // unmatched issuer
-    if ((parserType === 'LogoutResponse' || parserType === 'SAMLResponse')
-        && extractedProperties
-        && extractedProperties.issuer !== issuer) {
-        return Promise.reject('ERR_UNMATCH_ISSUER');
-    }
-    // invalid session time
-    // only run the verifyTime when `SessionNotOnOrAfter` exists
-    if (parserType === 'SAMLResponse'
-        && extractedProperties.sessionIndex.sessionNotOnOrAfter
-        && !verifyTime(undefined, extractedProperties.sessionIndex.sessionNotOnOrAfter, self.entitySetting.clockDrifts)) {
-        return Promise.reject('ERR_EXPIRED_SESSION');
-    }
-    // invalid time
-    // 2.4.1.2 https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
-    if (parserType === 'SAMLResponse'
-        && extractedProperties.conditions
-        && !verifyTime(extractedProperties.conditions.notBefore, extractedProperties.conditions.notOnOrAfter, self.entitySetting.clockDrifts)) {
-        return Promise.reject('ERR_CONDITION_UNCONFIRMED');
-    }
-    if (parserType === 'SAMLResponse') {
-        let destination = extractedProperties?.response?.destination;
-        let isExit = self?.entityMeta?.meta?.assertionConsumerService?.filter((item) => {
-            return item?.location === destination;
-        });
-        if (isExit?.length === 0) {
+    const validationError = runCommonValidation(parserType, parseResult.extract, self, from);
+    if (validationError) {
+        if (validationError === 'ERR_INVALID_DESTINATION') {
             return Promise.reject('ERR_Destination_URL');
         }
+        return Promise.reject(validationError);
     }
     return Promise.resolve(parseResult);
 }