Skip to content

Commit 3634910

Browse files
timleggetimlegge
committed
Add test of properly handling comments in nameid and email
1 parent 4c20821 commit 3634910

File tree

1 file changed

+193
-0
lines changed

1 file changed

+193
-0
lines changed

‎t/15-evil-nameid-and-email-assertion.t

+193
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
use strict;
2+
use warnings;
3+
use Test::Lib;
4+
use Test::Net::SAML2;
5+
6+
use Net::SAML2::Protocol::Assertion;
7+
8+
my $xml = <<'XML_FILE';
9+
<?xml version="1.0"?>
10+
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" ID="id-2806f1cc-9ec9-4b70-ae58-e252e58159f1" Version="2.0" IssueInstant="2021-11-26T01:36:44.454Z" InResponseTo="NETSAML2_1d8748c413abe58635d3c8b53b79633a" Destination="https://netsaml2-testapp.local/consumer-post">
11+
<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://idp.com/idp</saml:Issuer>
12+
<samlp:Status>
13+
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
14+
<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" ID="id-f58787c2-38e8-4dd4-b2bb-74cad987c88e" Version="2.0" IssueInstant="2021-11-26T01:36:44.454Z">
15+
<saml:Issuer>https://idp.com/idp</saml:Issuer>
16+
<saml:Subject>
17+
<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">[email protected]<!---->.evil.com</saml:NameID>
18+
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
19+
<saml:SubjectConfirmationData NotOnOrAfter="2021-11-26T01:53:24.455Z" Recipient="https://netsaml2-testapp.local/consumer-post" InResponseTo="NETSAML2_1d8748c413abe58635d3c8b53b79633a"/></saml:SubjectConfirmation>
20+
</saml:Subject>
21+
<saml:Conditions NotBefore="2021-11-26T01:35:44.455Z" NotOnOrAfter="2021-11-26T01:53:24.455Z">
22+
<saml:AudienceRestriction>
23+
<saml:Audience>https://netsaml2-testapp.local</saml:Audience>
24+
</saml:AudienceRestriction>
25+
</saml:Conditions>
26+
<saml:AuthnStatement AuthnInstant="2021-11-26T01:36:44.455Z" SessionNotOnOrAfter="2021-11-26T01:53:24.455Z" SessionIndex="bb6a1d05-b292-4a3c-acfa-b2d9101dbb97">
27+
<saml:AuthnContext>
28+
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
29+
<saml:AuthenticatingAuthority>https://idp.com/idp</saml:AuthenticatingAuthority>
30+
</saml:AuthnContext>
31+
</saml:AuthnStatement>
32+
<saml:AttributeStatement>
33+
<saml:Attribute Name="saml_subject" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
34+
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">43712857-1df8-4f6e-b476-a8fdc4446dd1</saml:AttributeValue>
35+
</saml:Attribute>
36+
<saml:Attribute Name="NickName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
37+
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">&#x30D1;&#x30B9;&#x30EF;&#x30FC;&#x30C9;&#x3092;&#x304A;&#x5FD8;&#x308C;&#x306E;&#x65B9;</saml:AttributeValue>
38+
</saml:Attribute>
39+
<saml:Attribute Name="FirstName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
40+
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Tester</saml:AttributeValue>
41+
</saml:Attribute>
42+
<saml:Attribute Name="EmailAddress" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
43+
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">[email protected]<!---->.evil.com</saml:AttributeValue>
44+
</saml:Attribute>
45+
</saml:AttributeStatement>
46+
<dsig:Signature>
47+
<dsig:SignedInfo xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
48+
<dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
49+
<dsig:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
50+
<dsig:Reference URI="#id-f58787c2-38e8-4dd4-b2bb-74cad987c88e">
51+
<dsig:Transforms>
52+
<dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
53+
<dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
54+
</dsig:Transforms>
55+
<dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
56+
<dsig:DigestValue>Wj9Mk/JZYSj/oun9jvIh8UUg3esvigRvZiUX+i3/PIs=</dsig:DigestValue>
57+
</dsig:Reference>
58+
</dsig:SignedInfo>
59+
<dsig:SignatureValue>YjRQvTacPUIL83QSUb5dQsDrfn+IrtgIIXjSp45l1n606Q2U6fw83O3Cw6O2gkDOZ5niC+kyI5OS
60+
mET6QQ/+uaPtxPFVk7dFwluMK3rLKsiIUO68jIKO1TWxwT1jhpYo+og/gIPFQkE48GHC91gWfN6T
61+
0senls89yDV+1ytKFiaXBqy/E0hkmxk13+fDLGEs1/C4pfwHiKf4aAtJmxsJ5f1PCZLk0ST1Hp6X
62+
dqbcnU3XbqeskyPGca/iA3d7LrDddl96LkfBB62eNcojv0XwVFxCxfSaFjnLcYSLjNforZf1NdoW
63+
zI9LioK6oIJwgNckhVU22dKXOcdacOYfbfdpgw==
64+
</dsig:SignatureValue>
65+
<dsig:KeyInfo><dsig:X509Data><dsig:X509Certificate>
66+
MIIFuDCCA6CgAwIBAgICEAMwDQYJKoZIhvcNAQELBQAwezELMAkGA1UEBhMCQ0Ex
67+
FjAUBgNVBAgMDU5ldyBCcnVuc3dpY2sxHTAbBgNVBAoMFENyeXB0LU9wZW5TU0wt
68+
VmVyaWZ5MTUwMwYDVQQDDCxDcnlwdC1PcGVuU1NMLVZlcmlmeSBTSEEtMjU2IElu
69+
dGVybWVkaWF0ZSBDQTAeFw0yMTA3MDMyMTAyMjRaFw0zMTA3MDEyMTAyMjRaMGcx
70+
CzAJBgNVBAYTAkNBMRYwFAYDVQQIDA1OZXcgQnJ1bnN3aWNrMRAwDgYDVQQHDAdN
71+
b25jdG9uMRAwDgYDVQQKDAdYTUwtU2lnMRwwGgYDVQQDDBN4bWwtc2lnLmV4YW1w
72+
bGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArkqxhCTOB2Xx
73+
FxCNWJt0bLWRQva6qOAPKiqlLfgJjG+YY2JaPtpO7WNV5oVqv9F21V/wgOkcQTZZ
74+
QQQl/L/eXlnFpJeSpF31dupLnzrBU29qWjedNCkj+y01sprJG+c++2d2jV8Qccp5
75+
5SklALtXYZ3K5OfILy4dFEqUyW0/Bk7Y/PdrAacAazumdNW2nw/ajbiXbUfm55Qe
76+
bQd/61emGettQBT9EUPOxMQrrtxHHxwyvrtsa9KyRPCamYEamOA0Al2Eya5dPWzE
77+
bndbVpRx1jz8Ec6ANk8wJHTkggJOUXWem7HL4x8v9hEQeaHEy5CwxKzodDpV2bA/
78+
Adr+NCYhsQIDAQABo4IBWDCCAVQwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMC
79+
BkAwMwYJYIZIAYb4QgENBCYWJE9wZW5TU0wgR2VuZXJhdGVkIFNlcnZlciBDZXJ0
80+
aWZpY2F0ZTAdBgNVHQ4EFgQUDYY0sUvDD+ttN7MKzQzVgg25D94wgboGA1UdIwSB
81+
sjCBr4AUzVMiKnV2P0l/W5nowtx2oIRM0S2hgZKkgY8wgYwxCzAJBgNVBAYTAkNB
82+
MRYwFAYDVQQIDA1OZXcgQnJ1bnN3aWNrMRAwDgYDVQQHDAdNb25jdG9uMR0wGwYD
83+
VQQKDBRDcnlwdC1PcGVuU1NMLVZlcmlmeTE0MDIGA1UEAwwrQ3J5cHQtT3BlblNT
84+
TC1WZXJpZnkgU0hBLTI1NiBSb290IEF1dGhvcml0eYICEAAwDgYDVR0PAQH/BAQD
85+
AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQAlDY7m
86+
1wwRB/X8NSeQ/Hvxg9dG4OofLFaC4e7dlC5kOT/ZIHQ6NIdzkQ2yOY1piKKYEYuO
87+
G/adtWAt8zRoejFob8W5aCA36uNoQLvdaMwXYNsJkzDNEmCB6vf3A28bVI+mlnt1
88+
+h3f0bkwxwHP2qYL8RneCL65GG+SWXHIipS/ZA5225mmT1oLo9xKeGK6vBgsOUum
89+
vxDgzmYyeGZYKpACWbOI7lR3C6PMR0oLKManLdb+ymngIk0bKB+Y2gr5cq/zURv8
90+
casiikjZT3MycPRV1AfQ3MYuXg6z4izkcG1U98E9Hr5p1gFsITmaY0aeK01a6xhx
91+
XkWKFTbraDn5ouTVMutW8xaVPU60zpYOcynxtRdgnYdmRR+c9dcD2xQmjtohuLxq
92+
RASCBC9iO7qTYkQvNW+yb63xbPDG05nokAfXpbp5hYVU8FYZHi8qOPtiaWiN9wbt
93+
ijsxDKZEcfiSGH5AEnkoaRCEqvbSNdtlbfYeDEnonsOZi9c+Kdl6A4PvOzTexwmi
94+
KPVgT8evWpQbubENw66vUOTqgkI+Bhbn87e1VELNUy+Uwz2OOcLEVvNkx0owswrH
95+
ujwb1+y1SYnlalLUt7PzEW85RNqVewGsHE8SD/1s70eYNYp7YJwLGPKJfyr3LvSl
96+
0qRfrYNhlewPc1MSVx7IFCZ4Qg+GFhg8TnEELQ==
97+
</dsig:X509Certificate></dsig:X509Data></dsig:KeyInfo>
98+
</dsig:Signature></saml:Assertion>
99+
<dsig:Signature>
100+
<dsig:SignedInfo xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
101+
<dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
102+
<dsig:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
103+
<dsig:Reference URI="#id-2806f1cc-9ec9-4b70-ae58-e252e58159f1">
104+
<dsig:Transforms>
105+
<dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
106+
<dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
107+
</dsig:Transforms>
108+
<dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
109+
<dsig:DigestValue>CTLVgcRtdRyS0Xj6WtjfYrV3BZkwZFU2cjPXXQln7tI=</dsig:DigestValue>
110+
</dsig:Reference>
111+
</dsig:SignedInfo>
112+
<dsig:SignatureValue>KCOW/WtwKZOrI6x+VzTKOyZ3cRJuUAPMYpsYiATzgCmfhymwORSytVmA+BJ+ZuFK1zxPk88UZJw0
113+
0mj2KBVN635WkFj+zDci79qm6zTwxNRprE6XnF5tSgXQTJH7bS5nIu0jGbSiR6EJVpKS3usDZ8/Z
114+
+tjkp2j/e2qeWDpXKUck8OCLclHkgzRa/sNXdGL20xc80qmVdkLCST+vUP92XUUlNM66EqvlOaHB
115+
wmEgQwfgurTnQPOCdb+Ypm5fvJjYXFrDJDKXY2AHu0LF+fO39Trx2FWjZ27UPH9NW6KOtKrhRtlH
116+
kV7ey4uddrz9t5Y08M12azJQIhgPMAszmVCXiw==
117+
</dsig:SignatureValue>
118+
<dsig:KeyInfo><dsig:X509Data><dsig:X509Certificate>
119+
MIIFuDCCA6CgAwIBAgICEAMwDQYJKoZIhvcNAQELBQAwezELMAkGA1UEBhMCQ0Ex
120+
FjAUBgNVBAgMDU5ldyBCcnVuc3dpY2sxHTAbBgNVBAoMFENyeXB0LU9wZW5TU0wt
121+
VmVyaWZ5MTUwMwYDVQQDDCxDcnlwdC1PcGVuU1NMLVZlcmlmeSBTSEEtMjU2IElu
122+
dGVybWVkaWF0ZSBDQTAeFw0yMTA3MDMyMTAyMjRaFw0zMTA3MDEyMTAyMjRaMGcx
123+
CzAJBgNVBAYTAkNBMRYwFAYDVQQIDA1OZXcgQnJ1bnN3aWNrMRAwDgYDVQQHDAdN
124+
b25jdG9uMRAwDgYDVQQKDAdYTUwtU2lnMRwwGgYDVQQDDBN4bWwtc2lnLmV4YW1w
125+
bGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArkqxhCTOB2Xx
126+
FxCNWJt0bLWRQva6qOAPKiqlLfgJjG+YY2JaPtpO7WNV5oVqv9F21V/wgOkcQTZZ
127+
QQQl/L/eXlnFpJeSpF31dupLnzrBU29qWjedNCkj+y01sprJG+c++2d2jV8Qccp5
128+
5SklALtXYZ3K5OfILy4dFEqUyW0/Bk7Y/PdrAacAazumdNW2nw/ajbiXbUfm55Qe
129+
bQd/61emGettQBT9EUPOxMQrrtxHHxwyvrtsa9KyRPCamYEamOA0Al2Eya5dPWzE
130+
bndbVpRx1jz8Ec6ANk8wJHTkggJOUXWem7HL4x8v9hEQeaHEy5CwxKzodDpV2bA/
131+
Adr+NCYhsQIDAQABo4IBWDCCAVQwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMC
132+
BkAwMwYJYIZIAYb4QgENBCYWJE9wZW5TU0wgR2VuZXJhdGVkIFNlcnZlciBDZXJ0
133+
aWZpY2F0ZTAdBgNVHQ4EFgQUDYY0sUvDD+ttN7MKzQzVgg25D94wgboGA1UdIwSB
134+
sjCBr4AUzVMiKnV2P0l/W5nowtx2oIRM0S2hgZKkgY8wgYwxCzAJBgNVBAYTAkNB
135+
MRYwFAYDVQQIDA1OZXcgQnJ1bnN3aWNrMRAwDgYDVQQHDAdNb25jdG9uMR0wGwYD
136+
VQQKDBRDcnlwdC1PcGVuU1NMLVZlcmlmeTE0MDIGA1UEAwwrQ3J5cHQtT3BlblNT
137+
TC1WZXJpZnkgU0hBLTI1NiBSb290IEF1dGhvcml0eYICEAAwDgYDVR0PAQH/BAQD
138+
AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQAlDY7m
139+
1wwRB/X8NSeQ/Hvxg9dG4OofLFaC4e7dlC5kOT/ZIHQ6NIdzkQ2yOY1piKKYEYuO
140+
G/adtWAt8zRoejFob8W5aCA36uNoQLvdaMwXYNsJkzDNEmCB6vf3A28bVI+mlnt1
141+
+h3f0bkwxwHP2qYL8RneCL65GG+SWXHIipS/ZA5225mmT1oLo9xKeGK6vBgsOUum
142+
vxDgzmYyeGZYKpACWbOI7lR3C6PMR0oLKManLdb+ymngIk0bKB+Y2gr5cq/zURv8
143+
casiikjZT3MycPRV1AfQ3MYuXg6z4izkcG1U98E9Hr5p1gFsITmaY0aeK01a6xhx
144+
XkWKFTbraDn5ouTVMutW8xaVPU60zpYOcynxtRdgnYdmRR+c9dcD2xQmjtohuLxq
145+
RASCBC9iO7qTYkQvNW+yb63xbPDG05nokAfXpbp5hYVU8FYZHi8qOPtiaWiN9wbt
146+
ijsxDKZEcfiSGH5AEnkoaRCEqvbSNdtlbfYeDEnonsOZi9c+Kdl6A4PvOzTexwmi
147+
KPVgT8evWpQbubENw66vUOTqgkI+Bhbn87e1VELNUy+Uwz2OOcLEVvNkx0owswrH
148+
ujwb1+y1SYnlalLUt7PzEW85RNqVewGsHE8SD/1s70eYNYp7YJwLGPKJfyr3LvSl
149+
0qRfrYNhlewPc1MSVx7IFCZ4Qg+GFhg8TnEELQ==
150+
</dsig:X509Certificate></dsig:X509Data></dsig:KeyInfo>
151+
</dsig:Signature></samlp:Response>
152+
XML_FILE
153+
154+
my $assertion = Net::SAML2::Protocol::Assertion->new_from_xml(xml => $xml);
155+
isa_ok($assertion, 'Net::SAML2::Protocol::Assertion');
156+
157+
is($assertion->in_response_to, 'NETSAML2_1d8748c413abe58635d3c8b53b79633a', 'In response to is correct');
158+
159+
is(scalar keys %{ $assertion->attributes }, 4, "Found four attributes");
160+
is(scalar @{ $assertion->attributes->{EmailAddress} }, 1);
161+
is(scalar @{ $assertion->attributes->{NickName} }, 1);
162+
is(scalar @{ $assertion->attributes->{FirstName} }, 1);
163+
164+
is($assertion->session, 'bb6a1d05-b292-4a3c-acfa-b2d9101dbb97', 'Session ID is correct');
165+
is($assertion->nameid, '[email protected]', "NameID properly ignored comments");
166+
isnt($assertion->nameid, '[email protected]', "NameID properly ignored comments");
167+
168+
cmp_deeply(
169+
$assertion->attributes,
170+
{
171+
EmailAddress => [qw([email protected])],
172+
FirstName => [qw(Tester)],
173+
NickName => [Encode::decode("utf8", 'パスワードをお忘れの方')],
174+
saml_subject => [qw(43712857-1df8-4f6e-b476-a8fdc4446dd1)],
175+
},
176+
"Assertion attributes are ok"
177+
);
178+
is($assertion->audience, 'https://netsaml2-testapp.local', "Assertion audience is netsaml2-testapp.local");
179+
is($assertion->valid('foo'), 0, "foo isn't a valid assertion");
180+
is($assertion->valid('https://netsaml2-testapp.local'), 0, "https://netsaml2-testapp.local isn't valid either");
181+
#
182+
## fudge validity times to test valid()
183+
$assertion->{not_before} = DateTime->now;
184+
$assertion->{not_after} = DateTime->now->add(minutes => 15);
185+
is($assertion->valid('https://netsaml2-testapp.local'), 1, "https://netsaml2-testapp.local is valid now - InResponseTo not Checked");
186+
is($assertion->valid('https://netsaml2-testapp.local', 'NETSAML2_1d8748c413abe58635d3c8b53b79633a'), 1, ".https://netsaml2-testapp.local is valid now - InResponseTo Checked");
187+
is($assertion->valid('https://netsaml2-testapp.local', 'N3k95Hg41WCHdwc9mqXyn'), 0, "Invalid InResponseTo Checked and failed");
188+
189+
$assertion->{not_before} = DateTime->now->add(minutes => 5);
190+
is($assertion->valid('https://netsaml2-testapp.local'), 0, "and invalid again - InResponseTo not Checked");
191+
is($assertion->valid('https://netsaml2-testapp.local', 'NETSAML2_1d8748c413abe58635d3c8b53b79633a'), 0, "and invalid again - InResponseTo Checked");
192+
#
193+
done_testing;

0 commit comments

Comments
 (0)