Add assertions to ensure NotBefore is before NotOnOrAfter

Author: tvdijen

src/XML/saml/AbstractSubjectConfirmationData.php

@@ -8,6 +8,7 @@
 use SimpleSAML\Assert\AssertionFailedException;
 use SimpleSAML\SAML2\Assert\Assert;
 use SimpleSAML\SAML2\Constants as C;
+use SimpleSAML\SAML2\Exception\ProtocolViolationException;
 use SimpleSAML\SAML2\Type\EntityIDValue;
 use SimpleSAML\SAML2\Type\SAMLDateTimeValue;
 use SimpleSAML\SAML2\Type\SAMLStringValue;
@@ -61,6 +62,15 @@ public function __construct(
         array $children = [],
         array $namespacedAttributes = [],
     ) {
+        /** SAML 2.0 Core specifications paragraph 2.4.1.2 */
+        if ($notBefore !== null && $notOnOrAfter !== null) {
+            Assert::true(
+                $notBefore->toDateTime() < $notOnOrAfter->toDateTime(),
+                "The value for NotBefore MUST be less than (earlier than) the value for NotOnOrAfter.",
+                ProtocolViolationException::class,
+            );
+        }
+
         if ($address !== null) {
             try {
                 /**

src/XML/saml/Conditions.php

@@ -43,6 +43,15 @@ public function __construct(
         protected ?OneTimeUse $oneTimeUse = null,
         protected ?ProxyRestriction $proxyRestriction = null,
     ) {
+        /** SAML 2.0 Core specifications paragraph 2.5.1.2 */
+        if ($notBefore !== null && $notOnOrAfter !== null) {
+            Assert::true(
+                $notBefore->toDateTime() < $notOnOrAfter->toDateTime(),
+                "The value for NotBefore MUST be less than (earlier than) the value for NotOnOrAfter.",
+                ProtocolViolationException::class,
+            );
+        }
+
         Assert::maxCount($condition, C::UNBOUNDED_LIMIT);
         Assert::allIsInstanceOf($condition, AbstractCondition::class);
         Assert::maxCount($audienceRestriction, C::UNBOUNDED_LIMIT);

tests/SAML2/XML/saml/AssertionTest.php

@@ -528,7 +528,7 @@ public function testCorrectSignatureMethodCanBeExtracted(): void
           <saml:SubjectConfirmationData NotOnOrAfter="2011-08-31T08:51:05Z" Recipient="https://sp.example.com/assertion_consumer" InResponseTo="_13603a6565a69297e9809175b052d115965121c8" />
         </saml:SubjectConfirmation>
       </saml:Subject>
-      <saml:Conditions NotOnOrAfter="2011-08-31T08:51:05Z" NotBefore="2011-08-31T08:51:05Z">
+      <saml:Conditions NotOnOrAfter="2011-08-31T08:51:05Z" NotBefore="2011-08-31T08:51:04Z">
         <saml:AudienceRestriction>
           <saml:Audience>urn:test:ServiceProvider</saml:Audience>
         </saml:AudienceRestriction>

tests/SAML2/XML/saml/ConditionsTest.php

@@ -8,6 +8,7 @@
 use PHPUnit\Framework\Attributes\Group;
 use PHPUnit\Framework\TestCase;
 use SimpleSAML\SAML2\Constants as C;
+use SimpleSAML\SAML2\Exception\ProtocolViolationException;
 use SimpleSAML\SAML2\Type\SAMLAnyURIValue;
 use SimpleSAML\SAML2\Type\SAMLDateTimeValue;
 use SimpleSAML\SAML2\XML\saml\AbstractSamlElement;
@@ -88,6 +89,19 @@ public function testMarshalling(): void
     }
 
 
+    /**
+     */
+    public function testMarshallingNotBeforeAfterNotOnOrAfter(): void
+    {
+        $this->expectException(ProtocolViolationException::class);
+
+        new Conditions(
+            SAMLDateTimeValue::fromString('2024-01-18T06:21:48Z'),
+            SAMLDateTimeValue::fromString('2014-07-17T01:01:18Z'),
+        );
+    }
+
+
     /**
      * Adding no contents to a Conditions element should yield an empty element. If there were contents already
      * there, those should be left untouched.

tests/SAML2/XML/saml/SubjectConfirmationDataTest.php

@@ -7,6 +7,7 @@
 use PHPUnit\Framework\Attributes\CoversClass;
 use PHPUnit\Framework\Attributes\Group;
 use PHPUnit\Framework\TestCase;
+use SimpleSAML\SAML2\Exception\ProtocolViolationException;
 use SimpleSAML\SAML2\Type\EntityIDValue;
 use SimpleSAML\SAML2\Type\SAMLDateTimeValue;
 use SimpleSAML\SAML2\Type\SAMLStringValue;
@@ -88,6 +89,19 @@ public function testMarshalling(): void
     }
 
 
+    /**
+     */
+    public function testMarshallingNotBeforeAfterNotOnOrAfter(): void
+    {
+        $this->expectException(ProtocolViolationException::class);
+
+        new SubjectConfirmationData(
+            SAMLDateTimeValue::fromString('2009-02-13T23:31:30Z'),
+            SAMLDateTimeValue::fromString('2001-04-19T04:25:21Z'),
+        );
+    }
+
+
     /**
      */
     public function testMarshallingWithNonIPAddress(): void