Skip to content

Commit 6b479bf

Browse files
blizzzblizzz
authored
Merge pull request #756 from nextcloud/backport/754/stable-5.1
[stable-5.1] fix(saml): enable xml entity loader where necessary
2 parents 5791824 + fb742b7 commit 6b479bf

File tree

11 files changed

+91
-24
lines changed

11 files changed

+91
-24
lines changed

‎.github/workflows/appstore-build-publish.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ jobs:
6666
run: npm i -g npm@"${{ steps.versions.outputs.npmVersion }}"
6767

6868
- name: Set up php ${{ env.PHP_VERSION }}
69-
uses: shivammathur/setup-php@v2
69+
uses: shivammathur/setup-php@4bd44f22a98a19e0950cbad5f31095157cc9621b
7070
with:
7171
php-version: ${{ env.PHP_VERSION }}
7272
coverage: none

‎.github/workflows/lint-info-xml.yml‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,29 +3,37 @@
33
# https://github.com/nextcloud/.github
44
# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
55

6-
name: Lint
6+
name: Lint info.xml
77

88
on:
99
pull_request:
1010
push:
1111
branches:
12+
- main
1213
- master
1314
- stable*
1415

16+
permissions:
17+
contents: read
18+
19+
concurrency:
20+
group: lint-info-xml-${{ github.head_ref || github.run_id }}
21+
cancel-in-progress: true
22+
1523
jobs:
1624
xml-linters:
1725
runs-on: ubuntu-latest
1826

1927
name: info.xml lint
2028
steps:
2129
- name: Checkout
22-
uses: actions/checkout@master
30+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
2331

2432
- name: Download schema
2533
run: wget https://raw.githubusercontent.com/nextcloud/appstore/master/nextcloudappstore/api/v1/release/info.xsd
2634

2735
- name: Lint info.xml
28-
uses: ChristophWurst/xmllint-action@v1
36+
uses: ChristophWurst/xmllint-action@39155a91429af431d65fafc21fa52ba5c4f5cb71 # v1.1
2937
with:
3038
xml-file: ./appinfo/info.xml
3139
xml-schema-file: ./info.xsd

‎.github/workflows/lint-php-cs.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
uses: actions/checkout@v3
2626

2727
- name: Set up php
28-
uses: shivammathur/setup-php@v2
28+
uses: shivammathur/setup-php@4bd44f22a98a19e0950cbad5f31095157cc9621b
2929
with:
3030
php-version: "7.4"
3131
coverage: none

‎.github/workflows/lint-php.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
uses: actions/checkout@v3
3535

3636
- name: Set up php ${{ matrix.php-versions }}
37-
uses: shivammathur/setup-php@v2
37+
uses: shivammathur/setup-php@4bd44f22a98a19e0950cbad5f31095157cc9621b
3838
with:
3939
php-version: ${{ matrix.php-versions }}
4040
coverage: none

‎.github/workflows/phpunit-mysql.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -79,11 +79,11 @@ jobs:
7979
path: apps/${{ env.APP_NAME }}
8080

8181
- name: Set up php ${{ matrix.php-versions }}
82-
uses: shivammathur/setup-php@v2
82+
uses: shivammathur/setup-php@4bd44f22a98a19e0950cbad5f31095157cc9621b
8383
with:
8484
php-version: ${{ matrix.php-versions }}
8585
tools: phpunit
86-
extensions: mbstring, iconv, fileinfo, intl, mysql, pdo_mysql
86+
extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, mysql, pdo_mysql
8787
coverage: none
8888

8989
- name: Check composer file existence

‎.github/workflows/phpunit-oci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,10 +71,10 @@ jobs:
7171
path: apps/${{ env.APP_NAME }}
7272

7373
- name: Set up php ${{ matrix.php-versions }}
74-
uses: shivammathur/setup-php@v2
74+
uses: shivammathur/setup-php@4bd44f22a98a19e0950cbad5f31095157cc9621b
7575
with:
7676
php-version: ${{ matrix.php-versions }}
77-
extensions: mbstring, fileinfo, intl, sqlite, pdo_sqlite, oci8
77+
extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, oci8
7878
tools: phpunit
7979
coverage: none
8080

‎.github/workflows/phpunit-pgsql.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,11 +76,11 @@ jobs:
7676
path: apps/${{ env.APP_NAME }}
7777

7878
- name: Set up php ${{ matrix.php-versions }}
79-
uses: shivammathur/setup-php@v2
79+
uses: shivammathur/setup-php@4bd44f22a98a19e0950cbad5f31095157cc9621b
8080
with:
8181
php-version: ${{ matrix.php-versions }}
8282
tools: phpunit
83-
extensions: mbstring, iconv, fileinfo, intl, pgsql, pdo_pgsql
83+
extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, pgsql, pdo_pgsql
8484
coverage: none
8585

8686
- name: Check composer file existence

‎.github/workflows/phpunit-sqlite.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,11 +67,11 @@ jobs:
6767
path: apps/${{ env.APP_NAME }}
6868

6969
- name: Set up php ${{ matrix.php-versions }}
70-
uses: shivammathur/setup-php@v2
70+
uses: shivammathur/setup-php@4bd44f22a98a19e0950cbad5f31095157cc9621b
7171
with:
7272
php-version: ${{ matrix.php-versions }}
7373
tools: phpunit
74-
extensions: mbstring, iconv, fileinfo, intl, sqlite, pdo_sqlite
74+
extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite
7575
coverage: none
7676

7777
- name: Check composer file existence

‎lib/Command/GetMetadata.php‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121

2222
namespace OCA\User_SAML\Command;
2323

24+
use OCA\User_SAML\Helper\TXmlHelper;
2425
use Symfony\Component\Console\Command\Command;
2526
use Symfony\Component\Console\Input\InputArgument;
2627
use Symfony\Component\Console\Input\InputInterface;
@@ -30,6 +31,7 @@
3031
use OneLogin\Saml2\Settings;
3132

3233
class GetMetadata extends Command {
34+
use TXmlHelper;
3335

3436
/** @var SAMLSettings */
3537
private $SAMLSettings;
@@ -71,7 +73,9 @@ protected function execute(InputInterface $input, OutputInterface $output) {
7173
$idp = (int)$input->getArgument('idp');
7274
$settings = new Settings($this->SAMLSettings->getOneLoginSettingsArray($idp));
7375
$metadata = $settings->getSPMetadata();
74-
$errors = $settings->validateMetadata($metadata);
76+
$errors = $this->callWithXmlEntityLoader(function () use ($settings, $metadata) {
77+
return $settings->validateMetadata($metadata);
78+
});
7579
if (empty($errors)) {
7680
$output->writeln($metadata);
7781
} else {

‎lib/Controller/SAMLController.php‎

Lines changed: 20 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
use OC\Core\Controller\ClientFlowLoginV2Controller;
2828
use OCA\User_SAML\Exceptions\NoUserFoundException;
2929
use OCA\User_SAML\Exceptions\UserFilterViolationException;
30+
use OCA\User_SAML\Helper\TXmlHelper;
3031
use OCA\User_SAML\SAMLSettings;
3132
use OCA\User_SAML\UserBackend;
3233
use OCA\User_SAML\UserData;
@@ -47,6 +48,8 @@
4748
use OneLogin\Saml2\ValidationError;
4849

4950
class SAMLController extends Controller {
51+
use TXmlHelper;
52+
5053
/** @var ISession */
5154
private $session;
5255
/** @var IUserSession */
@@ -289,7 +292,9 @@ public function login(int $idp = 1) {
289292
public function getMetadata(int $idp = 1) {
290293
$settings = new Settings($this->samlSettings->getOneLoginSettingsArray($idp));
291294
$metadata = $settings->getSPMetadata();
292-
$errors = $settings->validateMetadata($metadata);
295+
$errors = $this->callWithXmlEntityLoader(function () use ($settings, $metadata) {
296+
return $settings->validateMetadata($metadata);
297+
});
293298
if (empty($errors)) {
294299
return new Http\DataDownloadResponse($metadata, 'metadata.xml', 'text/xml');
295300
} else {
@@ -350,7 +355,10 @@ public function assertionConsumerService(): Http\RedirectResponse {
350355
}
351356

352357
$auth = new Auth($this->samlSettings->getOneLoginSettingsArray($idp));
353-
$auth->processResponse($AuthNRequestID);
358+
// validator (called with processResponse()) needs an XML entity loader
359+
$this->callWithXmlEntityLoader(function () use ($auth, $AuthNRequestID): void {
360+
$auth->processResponse($AuthNRequestID);
361+
});
354362

355363
$this->logger->debug('Attributes send by the IDP: ' . json_encode($auth->getAttributes()));
356364

@@ -510,13 +518,16 @@ private function tryProcessSLOResponse(?int $idp): array {
510518
foreach ($idps as $idp) {
511519
try {
512520
$auth = new Auth($this->samlSettings->getOneLoginSettingsArray($idp));
513-
$targetUrl = $auth->processSLO(
514-
true, // do not let processSLO to delete the entire session. Let userSession->logout do the job
515-
null,
516-
$this->samlSettings->usesSloWebServerDecode($idp),
517-
null,
518-
true
519-
);
521+
// validator (called with processSLO()) needs an XML entity loader
522+
$targetUrl = $this->callWithXmlEntityLoader(function () use ($auth, $idp): string {
523+
return $auth->processSLO(
524+
true, // do not let processSLO to delete the entire session. Let userSession->logout do the job
525+
null,
526+
$this->samlSettings->usesSloWebServerDecode($idp),
527+
null,
528+
true
529+
);
530+
});
520531
if ($auth->getLastErrorReason() === null) {
521532
return [$targetUrl, $auth];
522533
}

0 commit comments

Comments
 (0)