Skip to content

Commit 50ddb3f

Browse files
pitbulkpitbulk
committed
Fix RSA1 - RSA_SHA1 constants
1 parent f0956be commit 50ddb3f

File tree

10 files changed

+35
-31
lines changed

10 files changed

+35
-31
lines changed

‎lib/onelogin/ruby-saml/authrequest.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ def create_params(settings, params={})
4242
request_params = {"SAMLRequest" => base64_request}
4343

4444
if settings.security[:authn_requests_signed] && !settings.security[:embed_sign] && settings.private_key
45-
params['SigAlg'] = XMLSecurity::Document::SHA1
45+
params['SigAlg'] = XMLSecurity::Document::RSA_SHA1
4646
url_string = "SAMLRequest=#{CGI.escape(base64_request)}"
4747
url_string += "&RelayState=#{CGI.escape(params['RelayState'])}" if params['RelayState']
4848
url_string += "&SigAlg=#{CGI.escape(params['SigAlg'])}"

‎lib/onelogin/ruby-saml/logoutrequest.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ def create_params(settings, params={})
4040
request_params = {"SAMLRequest" => base64_request}
4141

4242
if settings.security[:logout_requests_signed] && !settings.security[:embed_sign] && settings.private_key
43-
params['SigAlg'] = XMLSecurity::Document::SHA1
43+
params['SigAlg'] = XMLSecurity::Document::RSA_SHA1
4444
url_string = "SAMLRequest=#{CGI.escape(base64_request)}"
4545
url_string += "&RelayState=#{CGI.escape(params['RelayState'])}" if params['RelayState']
4646
url_string += "&SigAlg=#{CGI.escape(params['SigAlg'])}"

‎lib/onelogin/ruby-saml/settings.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ def get_sp_key
114114
:logout_responses_signed => false,
115115
:embed_sign => false,
116116
:digest_method => XMLSecurity::Document::SHA1,
117-
:signature_method => XMLSecurity::Document::SHA1
117+
:signature_method => XMLSecurity::Document::RSA_SHA1
118118
}.freeze,
119119
:double_quote_xml_attribute_values => false,
120120
}.freeze

‎lib/onelogin/ruby-saml/slo_logoutresponse.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ def create_params(settings, request_id = nil, logout_message = nil, params = {})
4141
response_params = {"SAMLResponse" => base64_response}
4242

4343
if settings.security[:logout_responses_signed] && !settings.security[:embed_sign] && settings.private_key
44-
params['SigAlg'] = XMLSecurity::Document::SHA1
44+
params['SigAlg'] = XMLSecurity::Document::RSA_SHA1
4545
url_string = "SAMLResponse=#{CGI.escape(base64_response)}"
4646
url_string += "&RelayState=#{CGI.escape(params['RelayState'])}" if params['RelayState']
4747
url_string += "&SigAlg=#{CGI.escape(params['SigAlg'])}"

‎lib/xml_security.rb‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -71,10 +71,14 @@ def algorithm(element)
7171
end
7272

7373
class Document < BaseDocument
74-
SHA1 = "http://www.w3.org/2000/09/xmldsig#rsa-sha1"
75-
SHA256 = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
76-
SHA384 = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384"
77-
SHA512 = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"
74+
RSA_SHA1 = "http://www.w3.org/2000/09/xmldsig#rsa-sha1"
75+
RSA_SHA256 = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
76+
RSA_SHA384 = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384"
77+
RSA_SHA512 = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"
78+
SHA1 = "http://www.w3.org/2000/09/xmldsig#sha1"
79+
SHA256 = "http://www.w3.org/2001/04/xmldsig-more#sha256"
80+
SHA384 = "http://www.w3.org/2001/04/xmldsig-more#sha384"
81+
SHA512 = "http://www.w3.org/2001/04/xmldsig-more#sha512"
7882
ENVELOPED_SIG = "http://www.w3.org/2000/09/xmldsig#enveloped-signature"
7983
INC_PREFIX_LIST = "#default samlp saml ds xs xsi"
8084

@@ -101,7 +105,7 @@ def uuid
101105
#<KeyInfo />
102106
#<Object />
103107
#</Signature>
104-
def sign_document(private_key, certificate, signature_method = SHA1, digest_method = SHA1)
108+
def sign_document(private_key, certificate, signature_method = RSA_SHA1, digest_method = SHA1)
105109
noko = Nokogiri.parse(self.to_s)
106110
canon_doc = noko.canonicalize(canon_algorithm(C14N))
107111

@@ -118,7 +122,7 @@ def sign_document(private_key, certificate, signature_method = SHA1, digest_meth
118122
transforms_element.add_element("ds:Transform", {"Algorithm" => ENVELOPED_SIG})
119123
transforms_element.add_element("ds:Transform", {"Algorithm" => C14N})
120124
transforms_element.add_element("ds:InclusiveNamespaces", {"xmlns" => C14N, "PrefixList" => INC_PREFIX_LIST})
121-
125+
122126
digest_method_element = reference_element.add_element("ds:DigestMethod", {"Algorithm" => digest_method})
123127
reference_element.add_element("ds:DigestValue").text = compute_digest(canon_doc, algorithm(digest_method_element))
124128

‎test/logoutrequest_test.rb‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ class RequestTest < Minitest::Test
107107
inflated = decode_saml_request_payload(unauth_url)
108108
assert_match %r[<ds:SignatureValue>([a-zA-Z0-9/+=]+)</ds:SignatureValue>], inflated
109109
assert_match %r[<ds:SignatureMethod Algorithm='http://www.w3.org/2000/09/xmldsig#rsa-sha1'/>], inflated
110-
assert_match %r[<ds:DigestMethod Algorithm='http://www.w3.org/2000/09/xmldsig#rsa-sha1'/>], inflated
110+
assert_match %r[<ds:DigestMethod Algorithm='http://www.w3.org/2000/09/xmldsig#sha1'/>], inflated
111111
end
112112

113113
it "create a signed logout request with 256 digest and signature methods" do
@@ -118,7 +118,7 @@ class RequestTest < Minitest::Test
118118
# sign the logout request
119119
settings.security[:logout_requests_signed] = true
120120
settings.security[:embed_sign] = true
121-
settings.security[:signature_method] = XMLSecurity::Document::SHA256
121+
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
122122
settings.security[:digest_method] = XMLSecurity::Document::SHA512
123123
settings.certificate = ruby_saml_cert_text
124124
settings.private_key = ruby_saml_key_text
@@ -128,7 +128,7 @@ class RequestTest < Minitest::Test
128128

129129
assert_match %r[<ds:SignatureValue>([a-zA-Z0-9/+=]+)</ds:SignatureValue>], request_xml
130130
assert_match %r[<ds:SignatureMethod Algorithm='http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'/>], request_xml
131-
assert_match %r[<ds:DigestMethod Algorithm='http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'/>], request_xml
131+
assert_match %r[<ds:DigestMethod Algorithm='http://www.w3.org/2001/04/xmldsig-more#sha512'/>], request_xml
132132
end
133133
end
134134

@@ -140,19 +140,19 @@ class RequestTest < Minitest::Test
140140
settings.name_identifier_value = "f00f00"
141141
settings.security[:logout_requests_signed] = true
142142
settings.security[:embed_sign] = false
143-
settings.security[:signature_method] = XMLSecurity::Document::SHA1
143+
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
144144
settings.certificate = ruby_saml_cert_text
145145
settings.private_key = ruby_saml_key_text
146146

147147
params = OneLogin::RubySaml::Logoutrequest.new.create_params(settings)
148148
assert params['Signature']
149-
assert params['SigAlg'] == XMLSecurity::Document::SHA1
149+
assert params['SigAlg'] == XMLSecurity::Document::RSA_SHA1
150150

151151
# signature_method only affects the embedeed signature
152-
settings.security[:signature_method] = XMLSecurity::Document::SHA256
152+
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
153153
params = OneLogin::RubySaml::Logoutrequest.new.create_params(settings)
154154
assert params['Signature']
155-
assert params['SigAlg'] == XMLSecurity::Document::SHA1
155+
assert params['SigAlg'] == XMLSecurity::Document::RSA_SHA1
156156
end
157157
end
158158

‎test/request_test.rb‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,7 @@ class RequestTest < Minitest::Test
159159
request_xml = Base64.decode64(params["SAMLRequest"])
160160
assert_match %r[<ds:SignatureValue>([a-zA-Z0-9/+=]+)</ds:SignatureValue>], request_xml
161161
assert_match %r[<ds:SignatureMethod Algorithm='http://www.w3.org/2000/09/xmldsig#rsa-sha1'/>], request_xml
162-
assert_match %r[<ds:DigestMethod Algorithm='http://www.w3.org/2000/09/xmldsig#rsa-sha1'/>], request_xml
162+
assert_match %r[<ds:DigestMethod Algorithm='http://www.w3.org/2000/09/xmldsig#sha1'/>], request_xml
163163
end
164164

165165
it "create a signed request with 256 digest and signature methods" do
@@ -168,7 +168,7 @@ class RequestTest < Minitest::Test
168168
settings.idp_sso_target_url = "http://example.com?field=value"
169169
settings.security[:authn_requests_signed] = true
170170
settings.security[:embed_sign] = true
171-
settings.security[:signature_method] = XMLSecurity::Document::SHA256
171+
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
172172
settings.security[:digest_method] = XMLSecurity::Document::SHA512
173173
settings.certificate = ruby_saml_cert_text
174174
settings.private_key = ruby_saml_key_text
@@ -177,11 +177,10 @@ class RequestTest < Minitest::Test
177177
request_xml = Base64.decode64(params["SAMLRequest"])
178178
assert_match %r[<ds:SignatureValue>([a-zA-Z0-9/+=]+)</ds:SignatureValue>], request_xml
179179
assert_match %r[<ds:SignatureMethod Algorithm='http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'/>], request_xml
180-
assert_match %r[<ds:DigestMethod Algorithm='http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'/>], request_xml
180+
assert_match %r[<ds:DigestMethod Algorithm='http://www.w3.org/2001/04/xmldsig-more#sha512'/>], request_xml
181181
end
182182
end
183183

184-
185184
describe "when the settings indicate to sign the request" do
186185
it "create a signature parameter" do
187186
settings = OneLogin::RubySaml::Settings.new
@@ -190,19 +189,19 @@ class RequestTest < Minitest::Test
190189
settings.assertion_consumer_service_binding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
191190
settings.security[:authn_requests_signed] = true
192191
settings.security[:embed_sign] = false
193-
settings.security[:signature_method] = XMLSecurity::Document::SHA1
192+
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
194193
settings.certificate = ruby_saml_cert_text
195194
settings.private_key = ruby_saml_key_text
196195

197196
params = OneLogin::RubySaml::Authrequest.new.create_params(settings)
198197
assert params['Signature']
199-
assert params['SigAlg'] == XMLSecurity::Document::SHA1
198+
assert params['SigAlg'] == XMLSecurity::Document::RSA_SHA1
200199

201200
# signature_method only affects the embedeed signature
202201
settings.security[:signature_method] = XMLSecurity::Document::SHA256
203202
params = OneLogin::RubySaml::Authrequest.new.create_params(settings)
204203
assert params['Signature']
205-
assert params['SigAlg'] == XMLSecurity::Document::SHA1
204+
assert params['SigAlg'] == XMLSecurity::Document::RSA_SHA1
206205
end
207206
end
208207

‎test/response_test.rb‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -378,5 +378,6 @@ class RubySamlTest < Minitest::Test
378378
assert_equal($evalled, nil)
379379
end
380380
end
381+
381382
end
382383
end

‎test/settings_test.rb‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,13 +69,13 @@ class SettingsTest < Minitest::Test
6969
settings.security[:authn_requests_signed] = true
7070
settings.security[:embed_sign] = true
7171
settings.security[:digest_method] = XMLSecurity::Document::SHA256
72-
settings.security[:signature_method] = XMLSecurity::Document::SHA256
72+
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
7373

7474
new_settings = OneLogin::RubySaml::Settings.new
7575
assert_equal new_settings.security[:authn_requests_signed], false
7676
assert_equal new_settings.security[:embed_sign], false
7777
assert_equal new_settings.security[:digest_method], XMLSecurity::Document::SHA1
78-
assert_equal new_settings.security[:signature_method], XMLSecurity::Document::SHA1
78+
assert_equal new_settings.security[:signature_method], XMLSecurity::Document::RSA_SHA1
7979
end
8080
end
8181
end

‎test/slo_logoutresponse_test.rb‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ class SloLogoutresponseTest < Minitest::Test
8383
response_xml = Base64.decode64(params["SAMLResponse"])
8484
assert_match %r[<ds:SignatureValue>([a-zA-Z0-9/+=]+)</ds:SignatureValue>], response_xml
8585
response_xml =~ /<ds:SignatureMethod Algorithm='http:\/\/www.w3.org\/2000\/09\/xmldsig#rsa-sha1'\/>/
86-
response_xml =~ /<ds:DigestMethod Algorithm='http:\/\/www.w3.org\/2000\/09\/xmldsig#rsa-sha1'\/>/
86+
response_xml =~ /<ds:DigestMethod Algorithm='http:\/\/www.w3.org\/2000\/09\/xmldsig#sha1'\/>/
8787
end
8888

8989
it "create a signed logout response with 256 digest and signature methods" do
@@ -92,7 +92,7 @@ class SloLogoutresponseTest < Minitest::Test
9292
settings.idp_slo_target_url = "http://example.com?field=value"
9393
settings.security[:logout_responses_signed] = true
9494
settings.security[:embed_sign] = true
95-
settings.security[:signature_method] = XMLSecurity::Document::SHA256
95+
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
9696
settings.security[:digest_method] = XMLSecurity::Document::SHA512
9797
settings.certificate = ruby_saml_cert_text
9898
settings.private_key = ruby_saml_key_text
@@ -115,20 +115,20 @@ class SloLogoutresponseTest < Minitest::Test
115115
settings.assertion_consumer_service_binding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
116116
settings.security[:logout_responses_signed] = true
117117
settings.security[:embed_sign] = false
118-
settings.security[:signature_method] = XMLSecurity::Document::SHA1
118+
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
119119
settings.certificate = ruby_saml_cert_text
120120
settings.private_key = ruby_saml_key_text
121121

122122
request = OneLogin::RubySaml::SloLogoutrequest.new(logout_request_document)
123123
params = OneLogin::RubySaml::SloLogoutresponse.new.create_params(settings, request.id, "Custom Logout Message")
124124
assert params['Signature']
125-
assert params['SigAlg'] == XMLSecurity::Document::SHA1
125+
assert params['SigAlg'] == XMLSecurity::Document::RSA_SHA1
126126

127127
# signature_method only affects the embedeed signature
128128
settings.security[:signature_method] = XMLSecurity::Document::SHA256
129129
params = OneLogin::RubySaml::SloLogoutresponse.new.create_params(settings, request.id, "Custom Logout Message")
130130
assert params['Signature']
131-
assert params['SigAlg'] == XMLSecurity::Document::SHA1
131+
assert params['SigAlg'] == XMLSecurity::Document::RSA_SHA1
132132
end
133133
end
134134
end

0 commit comments

Comments
 (0)