Skip to content

Commit 859abfd

Browse files
tvdijentvdijen
committed
Backport XPath DoS patch
1 parent 93df4bf commit 859abfd

4 files changed

Lines changed: 76 additions & 0 deletions

File tree

‎src/SAML2/Utils.php‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
use DOMElement;
99
use DOMNode;
1010
use DOMXPath;
11+
use Exception;
1112
use RobRichards\XMLSecLibs\XMLSecEnc;
1213
use RobRichards\XMLSecLibs\XMLSecurityDSig;
1314
use RobRichards\XMLSecLibs\XMLSecurityKey;
@@ -70,6 +71,35 @@ public static function validateElement(DOMElement $root)
7071
$signatureElement = $signatureElement[0];
7172
$objXMLSecDSig->sigNode = $signatureElement;
7273

74+
/** Locate the XMLDSig Transform elements */
75+
/** @var \DOMElement[] $transformElement */
76+
$transformElement = self::xpQuery($signatureElement, './ds:SignedInfo/ds:Reference/ds:Transforms/ds:Transform');
77+
if (count($transformElement) > 2) {
78+
throw new Exception('XMLSec: more than two transform-operations in ds:Reference.');
79+
}
80+
81+
if (count($transformElement) > 0) {
82+
/** Check the algorithms in the Transform-elements */
83+
/** @var \DOMElement[] $algorithms */
84+
$algorithms = self::xpQuery(
85+
$signatureElement,
86+
sprintf(
87+
"./ds:SignedInfo/ds:Reference/ds:Transforms/ds:Transform["
88+
. "not(@Algorithm='%s') and not(@Algorithm='%s') and not(@Algorithm='%s')]",
89+
XMLSecurityDSig::EXC_C14N,
90+
XMLSecurityDSig::EXC_C14N_COMMENTS,
91+
'http://www.w3.org/2000/09/xmldsig#enveloped-signature',
92+
),
93+
);
94+
95+
if (count($algorithms) > 0) {
96+
throw new Exception(
97+
'XMLSec: Signatures in SAML messages SHOULD NOT contain transforms other than the '
98+
. 'enveloped signature transform or the exclusive canonicalization transforms.',
99+
);
100+
}
101+
}
102+
73103
/* Canonicalize the XMLDSig SignedInfo element in the message. */
74104
$objXMLSecDSig->canonicalizeSignedInfo();
75105

‎tests/SAML2/AssertionTest.php‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@
44

55
namespace SAML2;
66

7+
use DOMDocument;
8+
use Exception;
79
use SAML2\Assertion;
810
use SAML2\Constants;
911
use SAML2\DOMDocumentFactory;
@@ -1179,6 +1181,40 @@ public function testVerifySignedAssertionWrongKeyDSA() : void
11791181
}
11801182

11811183

1184+
/**
1185+
* Try to parse a signed assertion with more than two transforms.
1186+
*/
1187+
public function testVerifySignedAssertionTooManyTransforms() : void
1188+
{
1189+
$doc = new DOMDocument();
1190+
$doc->load(__DIR__ . '/signedassertion_too_many_transforms.xml');
1191+
1192+
$publicKey = CertificatesMock::getPublicKeySha256();
1193+
1194+
$this->expectException(Exception::class, 'XMLSec: more than two transform-operations in ds:Reference.');
1195+
new Assertion($doc->firstChild);
1196+
}
1197+
1198+
1199+
/**
1200+
* Try to parse a signed assertion with a transform algorithm that is not allowed.
1201+
*/
1202+
public function testVerifySignedAssertionProhibitedTransform() : void
1203+
{
1204+
$doc = new DOMDocument();
1205+
$doc->load(__DIR__ . '/signedassertion_prohibited_transform.xml');
1206+
1207+
$publicKey = CertificatesMock::getPublicKeySha256();
1208+
1209+
$this->expectException(
1210+
Exception::class,
1211+
'XMLSec: Signatures in SAML messages SHOULD NOT contain transforms other than the enveloped signature '
1212+
. 'transform or the exclusive canonicalization transforms.',
1213+
);
1214+
new Assertion($doc->firstChild);
1215+
}
1216+
1217+
11821218
/**
11831219
* Calling validate on an unsigned assertion must return
11841220
* false, not an exception.

‎tests/SAML2/signedassertion_prohibited_transform.xml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" ID="_d908a49b8b63665738430d1c5b655f297b91331864" Version="2.0" IssueInstant="2016-03-11T14:53:15Z"><saml:Issuer>https://thki-sid.pt-48.utr.surfcloud.nl/ssp/saml2/idp/metadata.php</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
2+
<ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
3+
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
4+
<ds:Reference URI="#_d908a49b8b63665738430d1c5b655f297b91331864"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#NotAllowed"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>3T1G7tVq5t3vYQEHerp8sRWakxs=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>pdcWOeAtYOnCAXSt/bTwtFHRM1Qk23NI85NMDXwUPpwC8RJ939fmleb3OL12LyO1lkOq7a8JRV/Qmav5CPapYMVMkNpN8Brz731rBcP9cPzcuXumP7h4m7HjxuAo4C+V6q6l981cuf/THsrX2PfG/+SFwwYzwAECb7JSHYFnoRc=</ds:SignatureValue>
5+
<ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIICgTCCAeoCCQCbOlrWDdX7FTANBgkqhkiG9w0BAQUFADCBhDELMAkGA1UEBhMCTk8xGDAWBgNVBAgTD0FuZHJlYXMgU29sYmVyZzEMMAoGA1UEBxMDRm9vMRAwDgYDVQQKEwdVTklORVRUMRgwFgYDVQQDEw9mZWlkZS5lcmxhbmcubm8xITAfBgkqhkiG9w0BCQEWEmFuZHJlYXNAdW5pbmV0dC5ubzAeFw0wNzA2MTUxMjAxMzVaFw0wNzA4MTQxMjAxMzVaMIGEMQswCQYDVQQGEwJOTzEYMBYGA1UECBMPQW5kcmVhcyBTb2xiZXJnMQwwCgYDVQQHEwNGb28xEDAOBgNVBAoTB1VOSU5FVFQxGDAWBgNVBAMTD2ZlaWRlLmVybGFuZy5ubzEhMB8GCSqGSIb3DQEJARYSYW5kcmVhc0B1bmluZXR0Lm5vMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDivbhR7P516x/S3BqKxupQe0LONoliupiBOesCO3SHbDrl3+q9IbfnfmE04rNuMcPsIxB161TdDpIesLCn7c8aPHISKOtPlAeTZSnb8QAu7aRjZq3+PbrP5uW3TcfCGPtKTytHOge/OlJbo078dVhXQ14d1EDwXJW1rRXuUt4C8QIDAQABMA0GCSqGSIb3DQEBBQUAA4GBACDVfp86HObqY+e8BUoWQ9+VMQx1ASDohBjwOsg2WykUqRXF+dLfcUH9dWR63CtZIKFDbStNomPnQz7nbK+onygwBspVEbnHuUihZq3ZUdmumQqCw4Uvs/1Uvq3orOo/WJVhTyvLgFVK2QarQ4/67OZfHd7R+POBXhophSMv1ZOo</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID SPNameQualifier="https://engine.test.surfconext.nl/authentication/sp/metadata" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">_1bbcf227253269d19a689c53cdd542fe2384a9538b</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2016-03-11T14:58:15Z" Recipient="https://engine.test.surfconext.nl/authentication/sp/consume-assertion" InResponseTo="CORTO6e667c685720477499c07c3864ac257271f1a212"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2016-03-11T14:52:45Z" NotOnOrAfter="2016-03-11T14:58:15Z"><saml:AudienceRestriction><saml:Audience>https://engine.test.surfconext.nl/authentication/sp/metadata</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2016-03-11T14:53:15Z" SessionNotOnOrAfter="2016-03-11T22:53:15Z" SessionIndex="_a2576e3e285e9e4d676b40b6c695b4a3cdc16ebd8b"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:mace:dir:attribute-def:uid" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml:AttributeValue xsi:type="xs:string">student2</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:mace:terena.org:attribute-def:schacHomeOrganization" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml:AttributeValue xsi:type="xs:string">university.example.org</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string">bbb.cc</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:schac:attribute-def:schacPersonalUniqueCode" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml:AttributeValue xsi:type="xs:string">urn:schac:personalUniqueCode:nl:local:uvt.nl:memberid:524020</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string">urn:schac:personalUniqueCode:nl:local:surfnet.nl:studentid:12345</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:mace:dir:attribute-def:eduPersonAffiliation" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml:AttributeValue xsi:type="xs:string">member</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string">student</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>

‎tests/SAML2/signedassertion_too_many_transforms.xml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" ID="_d908a49b8b63665738430d1c5b655f297b91331864" Version="2.0" IssueInstant="2016-03-11T14:53:15Z"><saml:Issuer>https://thki-sid.pt-48.utr.surfcloud.nl/ssp/saml2/idp/metadata.php</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
2+
<ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
3+
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
4+
<ds:Reference URI="#_d908a49b8b63665738430d1c5b655f297b91331864"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>3T1G7tVq5t3vYQEHerp8sRWakxs=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>pdcWOeAtYOnCAXSt/bTwtFHRM1Qk23NI85NMDXwUPpwC8RJ939fmleb3OL12LyO1lkOq7a8JRV/Qmav5CPapYMVMkNpN8Brz731rBcP9cPzcuXumP7h4m7HjxuAo4C+V6q6l981cuf/THsrX2PfG/+SFwwYzwAECb7JSHYFnoRc=</ds:SignatureValue>
5+
<ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIICgTCCAeoCCQCbOlrWDdX7FTANBgkqhkiG9w0BAQUFADCBhDELMAkGA1UEBhMCTk8xGDAWBgNVBAgTD0FuZHJlYXMgU29sYmVyZzEMMAoGA1UEBxMDRm9vMRAwDgYDVQQKEwdVTklORVRUMRgwFgYDVQQDEw9mZWlkZS5lcmxhbmcubm8xITAfBgkqhkiG9w0BCQEWEmFuZHJlYXNAdW5pbmV0dC5ubzAeFw0wNzA2MTUxMjAxMzVaFw0wNzA4MTQxMjAxMzVaMIGEMQswCQYDVQQGEwJOTzEYMBYGA1UECBMPQW5kcmVhcyBTb2xiZXJnMQwwCgYDVQQHEwNGb28xEDAOBgNVBAoTB1VOSU5FVFQxGDAWBgNVBAMTD2ZlaWRlLmVybGFuZy5ubzEhMB8GCSqGSIb3DQEJARYSYW5kcmVhc0B1bmluZXR0Lm5vMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDivbhR7P516x/S3BqKxupQe0LONoliupiBOesCO3SHbDrl3+q9IbfnfmE04rNuMcPsIxB161TdDpIesLCn7c8aPHISKOtPlAeTZSnb8QAu7aRjZq3+PbrP5uW3TcfCGPtKTytHOge/OlJbo078dVhXQ14d1EDwXJW1rRXuUt4C8QIDAQABMA0GCSqGSIb3DQEBBQUAA4GBACDVfp86HObqY+e8BUoWQ9+VMQx1ASDohBjwOsg2WykUqRXF+dLfcUH9dWR63CtZIKFDbStNomPnQz7nbK+onygwBspVEbnHuUihZq3ZUdmumQqCw4Uvs/1Uvq3orOo/WJVhTyvLgFVK2QarQ4/67OZfHd7R+POBXhophSMv1ZOo</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID SPNameQualifier="https://engine.test.surfconext.nl/authentication/sp/metadata" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">_1bbcf227253269d19a689c53cdd542fe2384a9538b</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2016-03-11T14:58:15Z" Recipient="https://engine.test.surfconext.nl/authentication/sp/consume-assertion" InResponseTo="CORTO6e667c685720477499c07c3864ac257271f1a212"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2016-03-11T14:52:45Z" NotOnOrAfter="2016-03-11T14:58:15Z"><saml:AudienceRestriction><saml:Audience>https://engine.test.surfconext.nl/authentication/sp/metadata</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement AuthnInstant="2016-03-11T14:53:15Z" SessionNotOnOrAfter="2016-03-11T22:53:15Z" SessionIndex="_a2576e3e285e9e4d676b40b6c695b4a3cdc16ebd8b"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:mace:dir:attribute-def:uid" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml:AttributeValue xsi:type="xs:string">student2</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:mace:terena.org:attribute-def:schacHomeOrganization" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml:AttributeValue xsi:type="xs:string">university.example.org</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string">bbb.cc</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:schac:attribute-def:schacPersonalUniqueCode" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml:AttributeValue xsi:type="xs:string">urn:schac:personalUniqueCode:nl:local:uvt.nl:memberid:524020</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string">urn:schac:personalUniqueCode:nl:local:surfnet.nl:studentid:12345</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:mace:dir:attribute-def:eduPersonAffiliation" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml:AttributeValue xsi:type="xs:string">member</saml:AttributeValue><saml:AttributeValue xsi:type="xs:string">student</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion>

0 commit comments

Comments
 (0)