Skip to content

Commit 3fd0098

Browse files
pitbulkpitbulk
authored
Merge branch 'master' into escape-strings-in-xml
2 parents 44ec6f5 + 8c66a14 commit 3fd0098

53 files changed

Lines changed: 2620 additions & 507 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/maven.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# This workflow will build a Java project with Maven
2+
# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-maven
3+
4+
name: java-saml CI with Maven
5+
6+
on: [push, pull_request]
7+
8+
jobs:
9+
test:
10+
11+
runs-on: ${{ matrix.os }}
12+
strategy:
13+
fail-fast: false
14+
matrix:
15+
java: [ '8', '11' ]
16+
os: [ 'ubuntu-latest' ]
17+
name: Java ${{ matrix.Java }} (${{ matrix.os }})
18+
steps:
19+
- uses: actions/checkout@v2
20+
- name: Set up Java
21+
uses: actions/setup-java@v2
22+
with:
23+
distribution: 'adopt'
24+
java-version: ${{ matrix.java }}
25+
- name: Maven Test
26+
run: mvn --batch-mode clean verify org.jacoco:jacoco-maven-plugin:report

‎.nvd-suppressions.xml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,52 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd">
3+
<suppress>
4+
<notes><![CDATA[
5+
file name: simple-xml-2.7.1.jar
6+
]]></notes>
7+
<sha1>dd91fb744c2ff921407475cb29a1e3fee397d411</sha1>
8+
<cve>CVE-2017-1000190</cve>
9+
</suppress>
10+
<suppress>
11+
<notes><![CDATA[
12+
file name: guava-19.0.jar
13+
]]></notes>
14+
<sha1>6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9</sha1>
15+
<cve>CVE-2018-10237</cve>
16+
</suppress>
17+
<suppress>
18+
<notes><![CDATA[
19+
file name: guava-19.0.jar
20+
]]></notes>
21+
<sha1>6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9</sha1>
22+
<cve>CVE-2020-8908</cve>
23+
</suppress>
24+
<suppress>
25+
<notes><![CDATA[
26+
file name: lang-tag-1.5.jar
27+
]]></notes>
28+
<sha1>7e82e3c4c593f85addf4bd209abde4f8ff933a07</sha1>
29+
<cve>CVE-2020-29242</cve>
30+
</suppress>
31+
<suppress>
32+
<notes><![CDATA[
33+
file name: lang-tag-1.5.jar
34+
]]></notes>
35+
<sha1>7e82e3c4c593f85addf4bd209abde4f8ff933a07</sha1>
36+
<cve>CVE-2020-29243</cve>
37+
</suppress>
38+
<suppress>
39+
<notes><![CDATA[
40+
file name: lang-tag-1.5.jar
41+
]]></notes>
42+
<sha1>7e82e3c4c593f85addf4bd209abde4f8ff933a07</sha1>
43+
<cve>CVE-2020-29244</cve>
44+
</suppress>
45+
<suppress>
46+
<notes><![CDATA[
47+
file name: lang-tag-1.5.jar
48+
]]></notes>
49+
<sha1>7e82e3c4c593f85addf4bd209abde4f8ff933a07</sha1>
50+
<cve>CVE-2020-29245</cve>
51+
</suppress>
352
</suppressions>

‎README.md‎

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,13 @@ In production, the **onelogin.saml2.strict** setting parameter MUST be set as **
7272

7373
In production also we highly recommend to register on the settings the IdP certificate instead of using the fingerprint method. The fingerprint, is a hash, so at the end is open to a collision attack that can end on a signature validation bypass. Other SAML toolkits deprecated that mechanism, we maintain it for compatibility and also to be used on test environment.
7474

75+
The IdPMetadataParser class does not validate in any way the URL that is introduced in order to be parsed.
76+
77+
Usually the same administrator that handles the Service Provider also sets the URL to the IdP, which should be a trusted resource.
78+
79+
But there are other scenarios, like a SAAS app where the administrator of the app delegates this functionality to other users. In this case, extra precaution should be taken in order to validate such URL inputs and avoid attacks like SSRF.
80+
81+
7582
## Installation
7683
### Hosting
7784
#### Github
@@ -355,6 +362,15 @@ onelogin.saml2.security.digest_algorithm = http://www.w3.org/2001/04/xmlenc#sha2
355362
# Reject Signatures with deprecated algorithms (sha1)
356363
onelogin.saml2.security.reject_deprecated_alg = true
357364

365+
# Enable trimming of parsed Name IDs and attribute values
366+
# SAML specification states that no trimming for string elements should be performed, so no trimming will be
367+
# performed by default on extracted Name IDs and attribute values. However, some SAML implementations may add
368+
# undesirable surrounding whitespace when outputting XML (possibly due to formatting/pretty-printing).
369+
# These two options allow to optionally enable value trimming on extracted Name IDs (including issuers) and
370+
# attribute values.
371+
onelogin.saml2.parsing.trim_name_ids = false
372+
onelogin.saml2.parsing.trim_attribute_values = false
373+
358374
# Organization
359375
onelogin.saml2.organization.name = SP Java
360376
onelogin.saml2.organization.displayname = SP Java Example
@@ -433,10 +449,10 @@ The AuthNRequest will be sent signed or unsigned based on the security settings
433449

434450
The IdP will then return the SAML Response to the user's client. The client is then forwarded to the Attribute Consumer Service of the SP with this information.
435451

436-
We can set a 'returnTo' url parameter to the login function and that will be converted as a 'RelayState' parameter:
452+
We can set a 'RelayState' parameter containing a return url to the login function:
437453
```
438-
String targetUrl = 'https://example.com';
439-
auth.login(returnTo=targetUrl)
454+
String returnUrl = 'https://example.com';
455+
auth.login(relayState=returnUrl)
440456
```
441457
The login method can receive 6 more optional parameters:
442458
- *forceAuthn* When true the AuthNRequest will have the 'ForceAuthn' attribute set to 'true'
@@ -605,10 +621,10 @@ The Logout Request will be sent signed or unsigned based on the security setting
605621

606622
The IdP will return the Logout Response through the user's client to the Single Logout Service of the SP.
607623

608-
We can set a 'returnTo' url parameter to the logout function and that will be converted as a 'RelayState' parameter:
624+
We can set a 'RelayState' parameter containing a return url to the login function:
609625
```
610-
String targetUrl = 'https://example.com';
611-
auth.logout(returnTo=targetUrl)
626+
String returnUrl = 'https://example.com';
627+
auth.logout(relayState=returnUrl)
612628
```
613629

614630
Also there are 7 optional parameters that can be set:

‎core/pom.xml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<parent>
44
<groupId>com.onelogin</groupId>
55
<artifactId>java-saml-toolkit</artifactId>
6-
<version>2.6.1-SNAPSHOT</version>
6+
<version>2.7.1-SNAPSHOT</version>
77
</parent>
88

99
<packaging>jar</packaging>
@@ -60,7 +60,7 @@
6060
<dependency>
6161
<groupId>org.apache.santuario</groupId>
6262
<artifactId>xmlsec</artifactId>
63-
<version>2.2.0</version>
63+
<version>2.2.2</version>
6464
</dependency>
6565
<dependency>
6666
<groupId>commons-codec</groupId>
@@ -72,13 +72,13 @@
7272
<dependency>
7373
<groupId>com.azure</groupId>
7474
<artifactId>azure-security-keyvault-keys</artifactId>
75-
<version>4.2.1</version>
75+
<version>4.3.0</version>
7676
<optional>true</optional>
7777
</dependency>
7878
<dependency>
7979
<groupId>com.azure</groupId>
8080
<artifactId>azure-identity</artifactId>
81-
<version>1.0.9</version>
81+
<version>1.3.3</version>
8282
<optional>true</optional>
8383
</dependency>
8484
</dependencies>
@@ -118,7 +118,10 @@
118118
<artifactId>maven-surefire-plugin</artifactId>
119119
<version>2.22.2</version>
120120
<configuration>
121-
<argLine>${jacoco.agent.argLine}</argLine>
121+
<encoding>${project.build.sourceEncoding}</encoding>
122+
<inputEncoding>${project.build.sourceEncoding}</inputEncoding>
123+
<outputEncoding>${project.build.sourceEncoding}</outputEncoding>
124+
<argLine>${jacoco.agent.argLine} -Dfile.encoding=${project.build.sourceEncoding} -Dline.separator=\n</argLine>
122125
</configuration>
123126
</plugin>
124127
<plugin>

‎core/src/main/java/com/onelogin/saml2/authn/AuthnRequest.java‎

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@
1111
import org.slf4j.Logger;
1212
import org.slf4j.LoggerFactory;
1313

14-
import com.onelogin.saml2.settings.Saml2Settings;
1514
import com.onelogin.saml2.model.Organization;
15+
import com.onelogin.saml2.settings.Saml2Settings;
1616
import com.onelogin.saml2.util.Constants;
1717
import com.onelogin.saml2.util.Util;
1818

@@ -101,7 +101,7 @@ public AuthnRequest(Saml2Settings settings, boolean forceAuthn, boolean isPassiv
101101
this.nameIdValueReq = nameIdValueReq;
102102

103103
StrSubstitutor substitutor = generateSubstitutor(settings);
104-
authnRequestString = substitutor.replace(getAuthnRequestTemplate());
104+
authnRequestString = postProcessXml(substitutor.replace(getAuthnRequestTemplate()), settings);
105105
LOGGER.debug("AuthNRequest --> " + authnRequestString);
106106
}
107107

@@ -121,6 +121,26 @@ public AuthnRequest(Saml2Settings settings, boolean forceAuthn, boolean isPassiv
121121
this(settings, forceAuthn, isPassive, setNameIdPolicy, null);
122122
}
123123

124+
/**
125+
* Allows for an extension class to post-process the AuthnRequest XML generated
126+
* for this request, in order to customize the result.
127+
* <p>
128+
* This method is invoked at construction time, after all the other fields of
129+
* this class have already been initialised. Its default implementation simply
130+
* returns the input XML as-is, with no change.
131+
*
132+
* @param authnRequestXml
133+
* the XML produced for this AuthnRequest by the standard
134+
* implementation provided by {@link AuthnRequest}
135+
* @param settings
136+
* the settings
137+
* @return the post-processed XML for this AuthnRequest, which will then be
138+
* returned by any call to {@link #getAuthnRequestXml()}
139+
*/
140+
protected String postProcessXml(final String authnRequestXml, final Saml2Settings settings) {
141+
return authnRequestXml;
142+
}
143+
124144
/**
125145
* @return the base64 encoded unsigned AuthnRequest (deflated or not)
126146
*
@@ -261,4 +281,13 @@ public String getId()
261281
{
262282
return id;
263283
}
284+
285+
/**
286+
* Returns the issue instant of this message.
287+
*
288+
* @return a new {@link Calendar} instance carrying the issue instant of this message
289+
*/
290+
public Calendar getIssueInstant() {
291+
return issueInstant == null? null: (Calendar) issueInstant.clone();
292+
}
264293
}

0 commit comments

Comments
 (0)