Remove last case of XMLSeclibs

Author: tvdijen

composer.json

@@ -33,8 +33,7 @@
         "simplesamlphp/assert": "~2.0",
         "simplesamlphp/xml-common": "~2.8",
         "simplesamlphp/xml-security": "~2.3",
-        "simplesamlphp/xml-soap": "~2.3",
-        "robrichards/xmlseclibs": "^3.1"
+        "simplesamlphp/xml-soap": "~2.3"
     },
     "require-dev": {
         "ext-intl": "*",

phpstan-baseline.neon

@@ -1,15 +1,5 @@
 parameters:
 	ignoreErrors:
-		-
-			message: '#^Call to an undefined method SimpleSAML\\SAML2\\XML\\samlp\\AbstractMessage\:\:addValidator\(\)\.$#'
-			identifier: method.notFound
-			path: src/Binding/HTTPArtifact.php
-
-		-
-			message: '#^Call to an undefined method SimpleSAML\\SAML2\\XML\\samlp\\ArtifactResponse\:\:validate\(\)\.$#'
-			identifier: method.notFound
-			path: src/Binding/HTTPArtifact.php
-
 		-
 			message: '#^Call to an undefined method SimpleSAML\\SAML2\\XML\\samlp\\AbstractMessage\:\:addValidator\(\)\.$#'
 			identifier: method.notFound

src/Binding/HTTPArtifact.php

@@ -9,12 +9,12 @@
 use Nyholm\Psr7\Response;
 use Psr\Http\Message\ResponseInterface;
 use Psr\Http\Message\ServerRequestInterface;
-use RobRichards\XMLSecLibs\XMLSecurityKey;
 use SimpleSAML\Configuration;
 use SimpleSAML\Metadata\MetaDataStorageHandler;
 use SimpleSAML\Module\saml\Message as MSG;
 use SimpleSAML\SAML2\Assert\Assert;
 use SimpleSAML\SAML2\Binding;
+use SimpleSAML\SAML2\Compat\ContainerSingleton;
 use SimpleSAML\SAML2\SOAPClient;
 use SimpleSAML\SAML2\Utils;
 use SimpleSAML\SAML2\XML\saml\Issuer;
@@ -24,6 +24,8 @@
 use SimpleSAML\SAML2\XML\samlp\ArtifactResponse;
 use SimpleSAML\Store\StoreFactory;
 use SimpleSAML\Utils\HTTP;
+use SimpleSAML\XMLSecurity\Alg\Signature\SignatureAlgorithmFactory;
+use SimpleSAML\XMLSecurity\TestUtils\PEMCertificatesMock;
 
 use function array_key_exists;
 use function base64_decode;
@@ -173,8 +175,10 @@ public function receive(ServerRequestInterface $request): AbstractMessage
         $soap = new SOAPClient();
 
         // Send message through SoapClient
-        /** @var \SimpleSAML\SAML2\XML\samlp\ArtifactResponse $artifactResponse */
         $artifactResponse = $soap->send($ar, $this->spMetadata, $idpMetadata);
+        if (!($artifactResponse instanceof ArtifactResponse)) {
+            throw new Exception('Invalid message received in response to our ArtifactResolve.');
+        }
 
         if (!$artifactResponse->isSuccess()) {
             throw new Exception('Received error from ArtifactResolutionService.');
@@ -183,18 +187,27 @@ public function receive(ServerRequestInterface $request): AbstractMessage
         $samlResponse = $artifactResponse->getMessage();
         if ($samlResponse === null) {
             /* Empty ArtifactResponse - possibly because of Artifact replay? */
-
             throw new Exception('Empty ArtifactResponse received, maybe a replay?');
         }
 
-        $samlResponse->addValidator([get_class($this), 'validateSignature'], $artifactResponse);
-
         $query = $request->getQueryParams();
         if (isset($query['RelayState'])) {
             $this->setRelayState($query['RelayState']);
         }
 
-        return $samlResponse;
+        if (!$samlResponse->isSigned()) {
+            return $samlResponse;
+        }
+
+        $container = ContainerSingleton::getInstance();
+        $blacklist = $container->getBlacklistedEncryptionAlgorithms();
+        $verifier = (new SignatureAlgorithmFactory($blacklist))->getAlgorithm(
+            $samlResponse->getSignature()->getSignedInfo()->getSignatureMethod()->getAlgorithm(),
+            // TODO:  Need to use the key from the metadata
+            PEMCertificatesMock::getPublicKey(PEMCertificatesMock::SELFSIGNED_PUBLIC_KEY),
+        );
+
+        return $samlResponse->verify($verifier);
     }
 
 
@@ -205,17 +218,4 @@ public function setSPMetadata(Configuration $sp): void
     {
         $this->spMetadata = $sp;
     }
-
-
-    /**
-     * A validator which returns true if the ArtifactResponse was signed with the given key
-     *
-     * @param \SimpleSAML\SAML2\XML\samlp\ArtifactResponse $message
-     * @param \RobRichards\XMLSecLibs\XMLSecurityKey  $key
-     */
-    public static function validateSignature(ArtifactResponse $message, XMLSecurityKey $key): bool
-    {
-        // @todo verify if this works and/or needs to do anything more. Ref. HTTPRedirect binding
-        return $message->validate($key);
-    }
 }