Add guard to limit amount of namespaces and transforms

Author: tvdijen

src/Constants.php

@@ -253,4 +253,10 @@ class Constants extends \SimpleSAML\XML\Constants
         self::C14N11_INCLUSIVE_WITH_COMMENTS,
         self::C14N11_INCLUSIVE_WITHOUT_COMMENTS,
     ];
+
+    /**
+     * Library default limits
+     */
+    public const int MAX_TRANSFORMS = 2;
+    public const int MAX_XPATH_NAMESPACES = 20;
 }

src/XML/CanonicalizableElementTrait.php

@@ -5,8 +5,10 @@
 namespace SimpleSAML\XMLSecurity\XML;
 
 use DOMElement;
+use SimpleSAML\XMLSecurity\Assert\Assert;
 use SimpleSAML\XMLSecurity\Constants as C;
 use SimpleSAML\XMLSecurity\Exception\CanonicalizationFailedException;
+use SimpleSAML\XMLSecurity\Exception\ReferenceValidationFailedException;
 use SimpleSAML\XMLSecurity\XML\ds\Transforms;
 use SimpleSAML\XPath\Constants as XPATH_C;
 
@@ -118,6 +120,13 @@ public function processTransforms(
         Transforms $transforms,
         DOMElement $data,
     ): string {
+        Assert::maxCount(
+            $transforms->getTransform(),
+            C::MAX_TRANSFORMS,
+            ReferenceValidationFailedException::class,
+            'Too many transforms.',
+        );
+
         $canonicalMethod = C::C14N_EXCLUSIVE_WITHOUT_COMMENTS;
         $arXPath = null;
         $prefixList = null;
@@ -140,9 +149,16 @@ public function processTransforms(
                         $arXPath = [];
                         $xpathValue = $xpath->getContent()->getValue();
                         $arXPath['query'] = '(.//. | .//@* | .//namespace::*)[' . $xpathValue . ']';
-
                         $arXpath['namespaces'] = $xpath->getNamespaces();
-                        $nslist = $xp->query('./namespace::*', $node);
+
+                        $nslist = $xpCache->query('./namespace::*', $xpath->toXML());
+                        Assert::lessThanEq(
+                            $nslist->count(),
+                            C::MAX_XPATH_NAMESPACES,
+                            ReferenceValidationFailedException::class,
+                            'Too many namespaces.',
+                        );
+
                         foreach ($nslist as $nsnode) {
                             if ($nsnode->localName != "xml") {
                                 $arXPath['namespaces'][$nsnode->localName] = $nsnode->nodeValue;