Skip to content

Commit 80e42c0

Browse files
tvdijentvdijen
committed
Merge branch 'release-7.x' into feature/dom-migration-php84
2 parents cfbd2ca + 21c2c99 commit 80e42c0

7 files changed

Lines changed: 71 additions & 46 deletions

File tree

‎.github/workflows/documentation.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
runs-on: [ubuntu-latest]
2020

2121
steps:
22-
- uses: actions/checkout@v6
22+
- uses: actions/checkout@v7
2323

2424
- name: Lint markdown files
2525
uses: nosborn/github-action-markdown-cli@v3

‎.github/workflows/interoperability.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,10 +47,10 @@ jobs:
4747
git config --global core.autocrlf false
4848
git config --global core.eol lf
4949
50-
- uses: actions/checkout@v6
50+
- uses: actions/checkout@v7
5151

5252
- name: Cache composer dependencies
53-
uses: actions/cache@v5
53+
uses: actions/cache@v6
5454
with:
5555
path: $(composer config cache-files-dir)
5656
key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -69,7 +69,7 @@ jobs:
6969
7070
- name: Cache metadata
7171
id: cache-metadata
72-
uses: actions/cache@v5
72+
uses: actions/cache@v6
7373
with:
7474
path: /tmp/metadata
7575
key: ${{ runner.os }}-metadata-${{ env.date }}

‎.github/workflows/php.yml‎

Lines changed: 46 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -71,13 +71,22 @@ jobs:
7171
git config --global core.autocrlf false
7272
git config --global core.eol lf
7373
74-
- uses: actions/checkout@v6
74+
- uses: actions/checkout@v7
7575

7676
- name: Get composer cache directory
7777
run: echo COMPOSER_CACHE="$(composer config cache-files-dir)" >> "$GITHUB_ENV"
7878

79+
- name: Get COMPOSER_ROOT_VERSION from composer.json branch alias
80+
run: |
81+
ROOT_VERSION=$(composer config extra.branch-alias.dev-master)
82+
if [ -z "$ROOT_VERSION" ]; then
83+
echo "Could not read extra.branch-alias.dev-master from composer.json" >&2
84+
exit 1
85+
fi
86+
echo "COMPOSER_ROOT_VERSION=$ROOT_VERSION" >> "$GITHUB_ENV"
87+
7988
- name: Cache composer dependencies
80-
uses: actions/cache@v5
89+
uses: actions/cache@v6
8190
with:
8291
path: ${{ env.COMPOSER_CACHE }}
8392
key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
@@ -134,13 +143,22 @@ jobs:
134143
git config --global core.autocrlf false
135144
git config --global core.eol lf
136145
137-
- uses: actions/checkout@v6
146+
- uses: actions/checkout@v7
138147

139148
- name: Get composer cache directory
140149
run: echo COMPOSER_CACHE="$(composer config cache-files-dir)" >> "$env:GITHUB_ENV"
141150

151+
- name: Get COMPOSER_ROOT_VERSION from composer.json branch alias
152+
run: |
153+
ROOT_VERSION=$(composer config extra.branch-alias.dev-master)
154+
if [ -z "$ROOT_VERSION" ]; then
155+
echo "Could not read extra.branch-alias.dev-master from composer.json" >&2
156+
exit 1
157+
fi
158+
echo "COMPOSER_ROOT_VERSION=$ROOT_VERSION" >> "$GITHUB_ENV"
159+
142160
- name: Cache composer dependencies
143-
uses: actions/cache@v5
161+
uses: actions/cache@v6
144162
with:
145163
path: ${{ env.COMPOSER_CACHE }}
146164
key: ${{ runner.os }}-composer-${{ hashFiles('**\composer.json') }}
@@ -172,13 +190,22 @@ jobs:
172190
- name: Setup problem matchers for PHP
173191
run: echo "::add-matcher::${{ runner.tool_cache }}/php.json"
174192

175-
- uses: actions/checkout@v6
193+
- uses: actions/checkout@v7
176194

177195
- name: Get composer cache directory
178196
run: echo COMPOSER_CACHE="$(composer config cache-files-dir)" >> "$GITHUB_ENV"
179197

198+
- name: Get COMPOSER_ROOT_VERSION from composer.json branch alias
199+
run: |
200+
ROOT_VERSION=$(composer config extra.branch-alias.dev-master)
201+
if [ -z "$ROOT_VERSION" ]; then
202+
echo "Could not read extra.branch-alias.dev-master from composer.json" >&2
203+
exit 1
204+
fi
205+
echo "COMPOSER_ROOT_VERSION=$ROOT_VERSION" >> "$GITHUB_ENV"
206+
180207
- name: Cache composer dependencies
181-
uses: actions/cache@v5
208+
uses: actions/cache@v6
182209
with:
183210
path: ${{ env.COMPOSER_CACHE }}
184211
key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
@@ -226,13 +253,22 @@ jobs:
226253
- name: Setup problem matchers for PHP
227254
run: echo "::add-matcher::${{ runner.tool_cache }}/php.json"
228255

229-
- uses: actions/checkout@v6
256+
- uses: actions/checkout@v7
230257

231258
- name: Get composer cache directory
232259
run: echo COMPOSER_CACHE="$(composer config cache-files-dir)" >> "$GITHUB_ENV"
233260

261+
- name: Get COMPOSER_ROOT_VERSION from composer.json branch alias
262+
run: |
263+
ROOT_VERSION=$(composer config extra.branch-alias.dev-master)
264+
if [ -z "$ROOT_VERSION" ]; then
265+
echo "Could not read extra.branch-alias.dev-master from composer.json" >&2
266+
exit 1
267+
fi
268+
echo "COMPOSER_ROOT_VERSION=$ROOT_VERSION" >> "$GITHUB_ENV"
269+
234270
- name: Cache composer dependencies
235-
uses: actions/cache@v5
271+
uses: actions/cache@v6
236272
with:
237273
path: ${{ env.COMPOSER_CACHE }}
238274
key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
@@ -255,15 +291,15 @@ jobs:
255291
runs-on: [ubuntu-latest]
256292
needs: [unit-tests-linux]
257293
steps:
258-
- uses: actions/checkout@v6
294+
- uses: actions/checkout@v7
259295

260296
- uses: actions/download-artifact@v8
261297
with:
262298
name: coverage-data
263299
path: ${{ github.workspace }}/build
264300

265301
- name: Codecov
266-
uses: codecov/codecov-action@v6
302+
uses: codecov/codecov-action@v7
267303
with:
268304
token: ${{ secrets.CODECOV_TOKEN }}
269305
fail_ci_if_error: true

‎composer.json‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,14 +34,13 @@
3434
"simplesamlphp/xml-common": "dev-feature/dom-migration-php84",
3535
"simplesamlphp/xml-security": "dev-feature/dom-migration-php84",
3636
"simplesamlphp/xml-soap": "dev-feature/dom-migration-php84",
37-
"robrichards/xmlseclibs": "^3.1"
3837
},
3938
"require-dev": {
4039
"ext-intl": "*",
4140

4241
"beste/clock": "~3.0",
4342
"mockery/mockery": "~1.6",
44-
"simplesamlphp/simplesamlphp": "2.5.*",
43+
"simplesamlphp/simplesamlphp": "^2.5",
4544
"simplesamlphp/simplesamlphp-test-framework": "~1.11",
4645
"icanhazstring/composer-unused": "^0.9.6"
4746
},

‎phpstan-baseline.neon‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,5 @@
11
parameters:
22
ignoreErrors:
3-
-
4-
message: '#^Call to an undefined method SimpleSAML\\SAML2\\XML\\samlp\\AbstractMessage\:\:addValidator\(\)\.$#'
5-
identifier: method.notFound
6-
path: src/Binding/HTTPArtifact.php
7-
8-
-
9-
message: '#^Call to an undefined method SimpleSAML\\SAML2\\XML\\samlp\\ArtifactResponse\:\:validate\(\)\.$#'
10-
identifier: method.notFound
11-
path: src/Binding/HTTPArtifact.php
12-
133
-
144
message: '#^Call to an undefined method SimpleSAML\\SAML2\\XML\\samlp\\AbstractMessage\:\:addValidator\(\)\.$#'
155
identifier: method.notFound

‎src/Binding/HTTPArtifact.php‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,12 @@
99
use Nyholm\Psr7\Response;
1010
use Psr\Http\Message\ResponseInterface;
1111
use Psr\Http\Message\ServerRequestInterface;
12-
use RobRichards\XMLSecLibs\XMLSecurityKey;
1312
use SimpleSAML\Configuration;
1413
use SimpleSAML\Metadata\MetaDataStorageHandler;
1514
use SimpleSAML\Module\saml\Message as MSG;
1615
use SimpleSAML\SAML2\Assert\Assert;
1716
use SimpleSAML\SAML2\Binding;
17+
use SimpleSAML\SAML2\Compat\ContainerSingleton;
1818
use SimpleSAML\SAML2\SOAPClient;
1919
use SimpleSAML\SAML2\Utils;
2020
use SimpleSAML\SAML2\XML\saml\Issuer;
@@ -24,6 +24,8 @@
2424
use SimpleSAML\SAML2\XML\samlp\ArtifactResponse;
2525
use SimpleSAML\Store\StoreFactory;
2626
use SimpleSAML\Utils\HTTP;
27+
use SimpleSAML\XMLSecurity\Alg\Signature\SignatureAlgorithmFactory;
28+
use SimpleSAML\XMLSecurity\TestUtils\PEMCertificatesMock;
2729

2830
use function array_key_exists;
2931
use function base64_decode;
@@ -175,8 +177,10 @@ public function receive(ServerRequestInterface $request): AbstractMessage
175177
$soap = new SOAPClient();
176178

177179
// Send message through SoapClient
178-
/** @var \SimpleSAML\SAML2\XML\samlp\ArtifactResponse $artifactResponse */
179180
$artifactResponse = $soap->send($ar, $this->spMetadata, $idpMetadata);
181+
if (!($artifactResponse instanceof ArtifactResponse)) {
182+
throw new Exception('Invalid message received in response to our ArtifactResolve.');
183+
}
180184

181185
if (!$artifactResponse->isSuccess()) {
182186
throw new Exception('Received error from ArtifactResolutionService.');
@@ -185,18 +189,27 @@ public function receive(ServerRequestInterface $request): AbstractMessage
185189
$samlResponse = $artifactResponse->getMessage();
186190
if ($samlResponse === null) {
187191
/* Empty ArtifactResponse - possibly because of Artifact replay? */
188-
189192
throw new Exception('Empty ArtifactResponse received, maybe a replay?');
190193
}
191194

192-
$samlResponse->addValidator([get_class($this), 'validateSignature'], $artifactResponse);
193-
194195
$query = $request->getQueryParams();
195196
if (isset($query['RelayState'])) {
196197
$this->setRelayState($query['RelayState']);
197198
}
198199

199-
return $samlResponse;
200+
if (!$samlResponse->isSigned()) {
201+
return $samlResponse;
202+
}
203+
204+
$container = ContainerSingleton::getInstance();
205+
$blacklist = $container->getBlacklistedEncryptionAlgorithms();
206+
$verifier = (new SignatureAlgorithmFactory($blacklist))->getAlgorithm(
207+
$samlResponse->getSignature()->getSignedInfo()->getSignatureMethod()->getAlgorithm(),
208+
// TODO: Need to use the key from the metadata
209+
PEMCertificatesMock::getPublicKey(PEMCertificatesMock::SELFSIGNED_PUBLIC_KEY),
210+
);
211+
212+
return $samlResponse->verify($verifier);
200213
}
201214

202215

@@ -207,17 +220,4 @@ public function setSPMetadata(Configuration $sp): void
207220
{
208221
$this->spMetadata = $sp;
209222
}
210-
211-
212-
/**
213-
* A validator which returns true if the ArtifactResponse was signed with the given key
214-
*
215-
* @param \SimpleSAML\SAML2\XML\samlp\ArtifactResponse $message
216-
* @param \RobRichards\XMLSecLibs\XMLSecurityKey $key
217-
*/
218-
public static function validateSignature(ArtifactResponse $message, XMLSecurityKey $key): bool
219-
{
220-
// @todo verify if this works and/or needs to do anything more. Ref. HTTPRedirect binding
221-
return $message->validate($key);
222-
}
223223
}

‎tests/SAML2/Constants.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*/
1212
class Constants extends \SimpleSAML\SAML2\Constants
1313
{
14-
public const string ENTITY_IDP = 'https://simplesamlphp.org/idp/metadata';
14+
public const string ENTITY_IDP = 'https://simplesamlphp.org/idp/metadata';
1515

1616
public const string ENTITY_SP = 'https://simplesamlphp.org/sp/metadata';
1717

0 commit comments

Comments
 (0)