samlify 2.11.0 → 2.13.0

package/README.md

@@ -3,7 +3,7 @@
 [![Build Status](https://img.shields.io/circleci/build/github/tngan/samlify?style=for-the-badge&logo=circleci)](https://app.circleci.com/pipelines/github/tngan/samlify)
 [![npm version](https://img.shields.io/npm/v/samlify.svg?style=for-the-badge&logo=npm)](https://www.npmjs.com/package/samlify)
 [![NPM](https://img.shields.io/npm/dm/samlify.svg?style=for-the-badge&logo=npm)](https://www.npmjs.com/package/samlify)
-[![Coverage Status](https://img.shields.io/coveralls/tngan/samlify/master.svg?style=for-the-badge&logo=coveralls)](https://coveralls.io/github/tngan/samlify?branch=master)
+[![Coverage](https://img.shields.io/badge/coverage-%E2%89%A590%25-brightgreen?style=for-the-badge&logo=vitest)](./vitest.config.ts)
 
 Highly configuarable Node.js SAML 2.0 library for Single Sign On
 

package/build/src/api.js

@@ -1,25 +1,74 @@
 "use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getContext = getContext;
 exports.setSchemaValidator = setSchemaValidator;
 exports.setDOMParserOptions = setDOMParserOptions;
+/**
+ * @file api.ts
+ * @author tngan
+ * @desc Global module configuration: XML schema validator and DOM parser.
+ */
 var xmldom_1 = require("@xmldom/xmldom");
+var XXE_SAFE_OPTIONS = {
+    /**
+     * Treat XML parsing errors as fatal to prevent XXE attacks.
+     * Entity references (e.g. &xxe;) and malformed XML in SAML messages
+     * are not expected and may indicate an attack attempt.
+     */
+    errorHandler: {
+        error: function (msg) { throw new Error("XML parsing error: ".concat(msg)); },
+        fatalError: function (msg) { throw new Error("XML fatal error: ".concat(msg)); },
+    },
+};
 var context = {
     validate: undefined,
-    dom: new xmldom_1.DOMParser()
+    dom: new xmldom_1.DOMParser(XXE_SAFE_OPTIONS),
 };
+/**
+ * Return the module-wide runtime context (DOM parser and validator).
+ *
+ * @returns shared context object
+ */
 function getContext() {
     return context;
 }
+/**
+ * Register the caller-supplied SAML schema validator. Throws when the
+ * supplied value does not expose a `validate` callback.
+ *
+ * @param params object with a `validate(xml)` callback
+ */
 function setSchemaValidator(params) {
     if (typeof params.validate !== 'function') {
         throw new Error('validate must be a callback function having one argument as xml input');
     }
-    // assign the validate function to the context
     context.validate = params.validate;
 }
+/**
+ * Replace the module-wide DOM parser with one configured by the caller.
+ *
+ * The XXE-safe error handlers are merged into the supplied options as a
+ * baseline so callers can override unrelated settings without
+ * accidentally disabling XXE protection (`saml-core §6.4`,
+ * `saml-sec-consider §6.3.1`). A caller can still opt out by passing
+ * its own `errorHandler`, but it must do so explicitly.
+ *
+ * @param options xmldom parser options
+ */
 function setDOMParserOptions(options) {
+    var _a;
     if (options === void 0) { options = {}; }
-    context.dom = new xmldom_1.DOMParser(options);
+    context.dom = new xmldom_1.DOMParser(__assign(__assign(__assign({}, XXE_SAFE_OPTIONS), options), { errorHandler: (_a = options.errorHandler) !== null && _a !== void 0 ? _a : XXE_SAFE_OPTIONS.errorHandler }));
 }
 //# sourceMappingURL=api.js.map

package/build/src/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/api.ts"],"names":[],"mappings":";;AAkBA,gCAEC;AAED,gDASC;AAED,kDAEC;AAnCD,yCAA+E;AAa/E,IAAM,OAAO,GAAY;IACvB,QAAQ,EAAE,SAAS;IACnB,GAAG,EAAE,IAAI,kBAAG,EAAE;CACf,CAAC;AAEF,SAAgB,UAAU;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAgB,kBAAkB,CAAC,MAAwB;IAEzD,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IAED,8CAA8C;IAC9C,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;AAErC,CAAC;AAED,SAAgB,mBAAmB,CAAC,OAA8B;IAA9B,wBAAA,EAAA,YAA8B;IAChE,OAAO,CAAC,GAAG,GAAG,IAAI,kBAAG,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/api.ts"],"names":[],"mappings":";;;;;;;;;;;;;AA0CA,gCAEC;AAQD,gDAKC;AAaD,kDAMC;AA5ED;;;;GAIG;AACH,yCAA+E;AAe/E,IAAM,gBAAgB,GAAqB;IACzC;;;;OAIG;IACH,YAAY,EAAE;QACZ,KAAK,EAAE,UAAC,GAAW,IAAO,MAAM,IAAI,KAAK,CAAC,6BAAsB,GAAG,CAAE,CAAC,CAAC,CAAC,CAAC;QACzE,UAAU,EAAE,UAAC,GAAW,IAAO,MAAM,IAAI,KAAK,CAAC,2BAAoB,GAAG,CAAE,CAAC,CAAC,CAAC,CAAC;KAC7E;CACF,CAAC;AAEF,IAAM,OAAO,GAAY;IACvB,QAAQ,EAAE,SAAS;IACnB,GAAG,EAAE,IAAI,kBAAG,CAAC,gBAAgB,CAAC;CAC/B,CAAC;AAEF;;;;GAIG;AACH,SAAgB,UAAU;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,MAAwB;IACzD,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;AACrC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,mBAAmB,CAAC,OAA8B;;IAA9B,wBAAA,EAAA,YAA8B;IAChE,OAAO,CAAC,GAAG,GAAG,IAAI,kBAAG,gCAChB,gBAAgB,GAChB,OAAO,KACV,YAAY,EAAE,MAAA,OAAO,CAAC,YAAY,mCAAI,gBAAgB,CAAC,YAAY,IACnE,CAAC;AACL,CAAC"}