don't allow duplicate saml:Assertion nodes at all

Author: steved

lib/samlr/assertion.rb

@@ -77,7 +77,7 @@ def verify_conditions!
     end
 
     def verify_assertion!
-      assertion_count = document.xpath(DEFAULT_LOCATION, NS_MAP).size
+      assertion_count = document.xpath("//saml:Assertion", NS_MAP).size
 
       if assertion_count == 0
         raise Samlr::FormatError.new("Invalid SAML response: assertion missing")

test/unit/test_response.rb

@@ -46,8 +46,7 @@
       modified_document.xpath("/samlp:Response/saml:Assertion", Samlr::NS_MAP).first["ID"] = "evil_id"
 
       response = Samlr::Response.new(modified_document.to_xml(:save_with => Nokogiri::XML::Node::SaveOptions::AS_XML), {:certificate => TEST_CERTIFICATE.x509})
-      assert_equal true, response.verify!
-      assert_equal "[email protected]", response.name_id
+      assert_raises(Samlr::FormatError) { response.verify! }
     end
   end