Skip to content

Commit 21c2c99

Browse files
tvdijentvdijen
committed
Merge branch 'master' into release-7.x
2 parents e4fa6ea + 275a655 commit 21c2c99

7 files changed

Lines changed: 35 additions & 46 deletions

File tree

‎.github/workflows/documentation.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
runs-on: [ubuntu-latest]
2020

2121
steps:
22-
- uses: actions/checkout@v6
22+
- uses: actions/checkout@v7
2323

2424
- name: Lint markdown files
2525
uses: nosborn/github-action-markdown-cli@v3

‎.github/workflows/interoperability.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,10 +47,10 @@ jobs:
4747
git config --global core.autocrlf false
4848
git config --global core.eol lf
4949
50-
- uses: actions/checkout@v6
50+
- uses: actions/checkout@v7
5151

5252
- name: Cache composer dependencies
53-
uses: actions/cache@v5
53+
uses: actions/cache@v6
5454
with:
5555
path: $(composer config cache-files-dir)
5656
key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -69,7 +69,7 @@ jobs:
6969
7070
- name: Cache metadata
7171
id: cache-metadata
72-
uses: actions/cache@v5
72+
uses: actions/cache@v6
7373
with:
7474
path: /tmp/metadata
7575
key: ${{ runner.os }}-metadata-${{ env.date }}

‎.github/workflows/php.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ jobs:
7171
git config --global core.autocrlf false
7272
git config --global core.eol lf
7373
74-
- uses: actions/checkout@v6
74+
- uses: actions/checkout@v7
7575

7676
- name: Get composer cache directory
7777
run: echo COMPOSER_CACHE="$(composer config cache-files-dir)" >> "$GITHUB_ENV"
@@ -86,7 +86,7 @@ jobs:
8686
echo "COMPOSER_ROOT_VERSION=$ROOT_VERSION" >> "$GITHUB_ENV"
8787
8888
- name: Cache composer dependencies
89-
uses: actions/cache@v5
89+
uses: actions/cache@v6
9090
with:
9191
path: ${{ env.COMPOSER_CACHE }}
9292
key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
@@ -143,7 +143,7 @@ jobs:
143143
git config --global core.autocrlf false
144144
git config --global core.eol lf
145145
146-
- uses: actions/checkout@v6
146+
- uses: actions/checkout@v7
147147

148148
- name: Get composer cache directory
149149
run: echo COMPOSER_CACHE="$(composer config cache-files-dir)" >> "$env:GITHUB_ENV"
@@ -158,7 +158,7 @@ jobs:
158158
echo "COMPOSER_ROOT_VERSION=$ROOT_VERSION" >> "$GITHUB_ENV"
159159
160160
- name: Cache composer dependencies
161-
uses: actions/cache@v5
161+
uses: actions/cache@v6
162162
with:
163163
path: ${{ env.COMPOSER_CACHE }}
164164
key: ${{ runner.os }}-composer-${{ hashFiles('**\composer.json') }}
@@ -190,7 +190,7 @@ jobs:
190190
- name: Setup problem matchers for PHP
191191
run: echo "::add-matcher::${{ runner.tool_cache }}/php.json"
192192

193-
- uses: actions/checkout@v6
193+
- uses: actions/checkout@v7
194194

195195
- name: Get composer cache directory
196196
run: echo COMPOSER_CACHE="$(composer config cache-files-dir)" >> "$GITHUB_ENV"
@@ -205,7 +205,7 @@ jobs:
205205
echo "COMPOSER_ROOT_VERSION=$ROOT_VERSION" >> "$GITHUB_ENV"
206206
207207
- name: Cache composer dependencies
208-
uses: actions/cache@v5
208+
uses: actions/cache@v6
209209
with:
210210
path: ${{ env.COMPOSER_CACHE }}
211211
key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
@@ -253,7 +253,7 @@ jobs:
253253
- name: Setup problem matchers for PHP
254254
run: echo "::add-matcher::${{ runner.tool_cache }}/php.json"
255255

256-
- uses: actions/checkout@v6
256+
- uses: actions/checkout@v7
257257

258258
- name: Get composer cache directory
259259
run: echo COMPOSER_CACHE="$(composer config cache-files-dir)" >> "$GITHUB_ENV"
@@ -268,7 +268,7 @@ jobs:
268268
echo "COMPOSER_ROOT_VERSION=$ROOT_VERSION" >> "$GITHUB_ENV"
269269
270270
- name: Cache composer dependencies
271-
uses: actions/cache@v5
271+
uses: actions/cache@v6
272272
with:
273273
path: ${{ env.COMPOSER_CACHE }}
274274
key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
@@ -291,15 +291,15 @@ jobs:
291291
runs-on: [ubuntu-latest]
292292
needs: [unit-tests-linux]
293293
steps:
294-
- uses: actions/checkout@v6
294+
- uses: actions/checkout@v7
295295

296296
- uses: actions/download-artifact@v8
297297
with:
298298
name: coverage-data
299299
path: ${{ github.workspace }}/build
300300

301301
- name: Codecov
302-
uses: codecov/codecov-action@v6
302+
uses: codecov/codecov-action@v7
303303
with:
304304
token: ${{ secrets.CODECOV_TOKEN }}
305305
fail_ci_if_error: true

‎composer.json‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,7 @@
3333
"simplesamlphp/assert": "~2.0",
3434
"simplesamlphp/xml-common": "~2.8",
3535
"simplesamlphp/xml-security": "~2.3",
36-
"simplesamlphp/xml-soap": "~2.3",
37-
"robrichards/xmlseclibs": "^3.1"
36+
"simplesamlphp/xml-soap": "~2.3"
3837
},
3938
"require-dev": {
4039
"ext-intl": "*",

‎phpstan-baseline.neon‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,5 @@
11
parameters:
22
ignoreErrors:
3-
-
4-
message: '#^Call to an undefined method SimpleSAML\\SAML2\\XML\\samlp\\AbstractMessage\:\:addValidator\(\)\.$#'
5-
identifier: method.notFound
6-
path: src/Binding/HTTPArtifact.php
7-
8-
-
9-
message: '#^Call to an undefined method SimpleSAML\\SAML2\\XML\\samlp\\ArtifactResponse\:\:validate\(\)\.$#'
10-
identifier: method.notFound
11-
path: src/Binding/HTTPArtifact.php
12-
133
-
144
message: '#^Call to an undefined method SimpleSAML\\SAML2\\XML\\samlp\\AbstractMessage\:\:addValidator\(\)\.$#'
155
identifier: method.notFound

‎src/Binding/HTTPArtifact.php‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,12 @@
99
use Nyholm\Psr7\Response;
1010
use Psr\Http\Message\ResponseInterface;
1111
use Psr\Http\Message\ServerRequestInterface;
12-
use RobRichards\XMLSecLibs\XMLSecurityKey;
1312
use SimpleSAML\Configuration;
1413
use SimpleSAML\Metadata\MetaDataStorageHandler;
1514
use SimpleSAML\Module\saml\Message as MSG;
1615
use SimpleSAML\SAML2\Assert\Assert;
1716
use SimpleSAML\SAML2\Binding;
17+
use SimpleSAML\SAML2\Compat\ContainerSingleton;
1818
use SimpleSAML\SAML2\SOAPClient;
1919
use SimpleSAML\SAML2\Utils;
2020
use SimpleSAML\SAML2\XML\saml\Issuer;
@@ -24,6 +24,8 @@
2424
use SimpleSAML\SAML2\XML\samlp\ArtifactResponse;
2525
use SimpleSAML\Store\StoreFactory;
2626
use SimpleSAML\Utils\HTTP;
27+
use SimpleSAML\XMLSecurity\Alg\Signature\SignatureAlgorithmFactory;
28+
use SimpleSAML\XMLSecurity\TestUtils\PEMCertificatesMock;
2729

2830
use function array_key_exists;
2931
use function base64_decode;
@@ -173,8 +175,10 @@ public function receive(ServerRequestInterface $request): AbstractMessage
173175
$soap = new SOAPClient();
174176

175177
// Send message through SoapClient
176-
/** @var \SimpleSAML\SAML2\XML\samlp\ArtifactResponse $artifactResponse */
177178
$artifactResponse = $soap->send($ar, $this->spMetadata, $idpMetadata);
179+
if (!($artifactResponse instanceof ArtifactResponse)) {
180+
throw new Exception('Invalid message received in response to our ArtifactResolve.');
181+
}
178182

179183
if (!$artifactResponse->isSuccess()) {
180184
throw new Exception('Received error from ArtifactResolutionService.');
@@ -183,18 +187,27 @@ public function receive(ServerRequestInterface $request): AbstractMessage
183187
$samlResponse = $artifactResponse->getMessage();
184188
if ($samlResponse === null) {
185189
/* Empty ArtifactResponse - possibly because of Artifact replay? */
186-
187190
throw new Exception('Empty ArtifactResponse received, maybe a replay?');
188191
}
189192

190-
$samlResponse->addValidator([get_class($this), 'validateSignature'], $artifactResponse);
191-
192193
$query = $request->getQueryParams();
193194
if (isset($query['RelayState'])) {
194195
$this->setRelayState($query['RelayState']);
195196
}
196197

197-
return $samlResponse;
198+
if (!$samlResponse->isSigned()) {
199+
return $samlResponse;
200+
}
201+
202+
$container = ContainerSingleton::getInstance();
203+
$blacklist = $container->getBlacklistedEncryptionAlgorithms();
204+
$verifier = (new SignatureAlgorithmFactory($blacklist))->getAlgorithm(
205+
$samlResponse->getSignature()->getSignedInfo()->getSignatureMethod()->getAlgorithm(),
206+
// TODO: Need to use the key from the metadata
207+
PEMCertificatesMock::getPublicKey(PEMCertificatesMock::SELFSIGNED_PUBLIC_KEY),
208+
);
209+
210+
return $samlResponse->verify($verifier);
198211
}
199212

200213

@@ -205,17 +218,4 @@ public function setSPMetadata(Configuration $sp): void
205218
{
206219
$this->spMetadata = $sp;
207220
}
208-
209-
210-
/**
211-
* A validator which returns true if the ArtifactResponse was signed with the given key
212-
*
213-
* @param \SimpleSAML\SAML2\XML\samlp\ArtifactResponse $message
214-
* @param \RobRichards\XMLSecLibs\XMLSecurityKey $key
215-
*/
216-
public static function validateSignature(ArtifactResponse $message, XMLSecurityKey $key): bool
217-
{
218-
// @todo verify if this works and/or needs to do anything more. Ref. HTTPRedirect binding
219-
return $message->validate($key);
220-
}
221221
}

‎tests/SAML2/Constants.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*/
1212
class Constants extends \SimpleSAML\SAML2\Constants
1313
{
14-
public const string ENTITY_IDP = 'https://simplesamlphp.org/idp/metadata';
14+
public const string ENTITY_IDP = 'https://simplesamlphp.org/idp/metadata';
1515

1616
public const string ENTITY_SP = 'https://simplesamlphp.org/sp/metadata';
1717

0 commit comments

Comments
 (0)