Skip to content

Commit ba61295

Browse files
pitbulkpitbulk
committed
Fix generateNameID tests
1 parent 071dcfc commit ba61295

File tree

2 files changed

+32
-20
lines changed

2 files changed

+32
-20
lines changed

‎tests/src/OneLogin/Saml2/ResponseTest.php‎

Lines changed: 17 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
use OneLogin\Saml2\ValidationError;
99

1010
use DOMDocument;
11+
use Exception;
1112

1213
/**
1314
* Unit tests for Response messages
@@ -136,7 +137,7 @@ public function testReturnNameId()
136137
$xml3 = file_get_contents(TEST_ROOT . '/data/responses/valid_encrypted_assertion.xml.base64');
137138
$response3 = new Response($this->_settings, $xml3);
138139
$this->assertEquals('_68392312d490db6d355555cfbbd8ec95d746516f60', $response3->getNameId());
139-
140+
140141
$xml4 = file_get_contents(TEST_ROOT . '/data/responses/invalids/no_nameid.xml.base64');
141142
$response4 = new Response($this->_settings, $xml4);
142143

@@ -225,7 +226,7 @@ public function testGetNameIdFormat()
225226
$xml2 = file_get_contents(TEST_ROOT . '/data/responses/response_encrypted_nameid.xml.base64');
226227
$response2 = new Response($this->_settings, $xml2);
227228
$this->assertEquals('urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified', $response2->getNameIdFormat());
228-
229+
229230
$xml3 = file_get_contents(TEST_ROOT . '/data/responses/valid_encrypted_assertion.xml.base64');
230231
$response3 = new Response($this->_settings, $xml3);
231232
$this->assertEquals('urn:oasis:names:tc:SAML:2.0:nameid-format:transient', $response3->getNameIdFormat());
@@ -462,7 +463,7 @@ public function testCheckStatus()
462463

463464
$xmlEnc = file_get_contents(TEST_ROOT . '/data/responses/valid_encrypted_assertion.xml.base64');
464465
$responseEnc = new Response($this->_settings, $xmlEnc);
465-
466+
466467
$response->checkStatus();
467468

468469
$xml2 = file_get_contents(TEST_ROOT . '/data/responses/invalids/status_code_responder.xml.base64');
@@ -773,11 +774,14 @@ public function testDoesNotAllowSignatureWrappingAttack2()
773774
$settings = new Settings($settingsInfo);
774775

775776
$xml = file_get_contents(TEST_ROOT . '/data/responses/wrapped_response_3.xml.base64');
776-
$response = new Response($settings, $xml);
777-
778-
$valid = $response->isValid();
779-
780-
$this->assertFalse($valid);
777+
try {
778+
$response = new Response($settings, $xml);
779+
$valid = $response->isValid();
780+
$this->assertFalse($valid);
781+
$this->assertEquals('Found an invalid Signed Element. SAML Response rejected', $response->getError());
782+
} catch (Exception $e) {
783+
$this->assertEquals('DOMDocument::loadXML(): Namespace prefix saml on Assertion is not defined in Entity, line: 1', $e->getMessage());
784+
}
781785
}
782786

783787
/**
@@ -811,7 +815,7 @@ public function testGetSessionNotOnOrAfter()
811815
$response = new Response($this->_settings, $xml);
812816

813817
$this->assertEquals(1290203857, $response->getSessionNotOnOrAfter());
814-
818+
815819
// An assertion that do not specified Session timeout should return NULL
816820
$xml2 = file_get_contents(TEST_ROOT . '/data/responses/response2.xml.base64');
817821
$response2 = new Response($this->_settings, $xml2);
@@ -1330,7 +1334,7 @@ public function testIsInValidRequestId()
13301334
$response2 = new Response($this->_settings, $message);
13311335
$response2->isValid($requestId);
13321336
$this->assertContains('The InResponseTo of the Response', $response2->getError());
1333-
1337+
13341338
$validRequestId = '_57bcbf70-7b1f-012e-c821-782bcb13bb38';
13351339
$response2->isValid($validRequestId);
13361340
$this->assertContains('No Signature found. SAML Response rejected', $response2->getError());
@@ -1500,7 +1504,7 @@ public function testIsInValidEncIssues()
15001504

15011505
$this->assertFalse($response3->isValid());
15021506
$this->assertEquals('The assertion of the Response is not encrypted and the SP requires it', $response3->getError());
1503-
1507+
15041508
$settingsInfo['security']['wantAssertionsEncrypted'] = false;
15051509
$settingsInfo['security']['wantNameIdEncrypted'] = true;
15061510
$settingsInfo['strict'] = false;
@@ -1679,7 +1683,7 @@ public function testIsValidSign()
16791683
$xml = file_get_contents(TEST_ROOT . '/data/responses/signed_message_response.xml.base64');
16801684
$response = new Response($this->_settings, $xml);
16811685
$this->assertTrue($response->isValid());
1682-
1686+
16831687
$xml2 = file_get_contents(TEST_ROOT . '/data/responses/signed_assertion_response.xml.base64');
16841688
$response2 = new Response($this->_settings, $xml2);
16851689
$this->assertTrue($response2->isValid());
@@ -1738,7 +1742,7 @@ public function testIsValidSignUsingX509certMulti()
17381742
{
17391743
$settingsDir = TEST_ROOT .'/settings/';
17401744
include $settingsDir.'settings6.php';
1741-
1745+
17421746
$settings = new Settings($settingsInfo);
17431747

17441748
$xml = file_get_contents(TEST_ROOT . '/data/responses/signed_message_response.xml.base64');

‎tests/src/OneLogin/Saml2/UtilsTest.php‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,12 @@ public function testLoadXML()
3131
$dom = new DOMDocument();
3232

3333
$metadataUnloaded = '<xml><EntityDescriptor>';
34-
$res1 = Utils::loadXML($dom, $metadataUnloaded);
35-
$this->assertFalse($res1);
34+
try {
35+
$res1 = Utils::loadXML($dom, $metadataUnloaded);
36+
$this->assertFalse($res1);
37+
} catch (Exception $e) {
38+
$this->assertEquals('DOMDocument::loadXML(): Premature end of data in tag EntityDescriptor line 1 in Entity, line: 1', $e->getMessage());
39+
}
3640

3741
$metadataInvalid = file_get_contents(TEST_ROOT .'/data/metadata/noentity_metadata_settings1.xml');
3842
$res2 = Utils::loadXML($dom, $metadataInvalid);
@@ -53,7 +57,7 @@ public function testXMLAttacks()
5357
$dom = new DOMDocument();
5458

5559
$attackXXE = '<?xml version="1.0" encoding="ISO-8859-1"?>
56-
<!DOCTYPE foo [
60+
<!DOCTYPE foo [
5761
<!ELEMENT foo ANY >
5862
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>';
5963
try {
@@ -851,12 +855,15 @@ public function testGenerateNameIdWithSPNameQualifier()
851855
$key
852856
);
853857

854-
$nameidExpectedEnc = '<saml:EncryptedID><xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Type="http://www.w3.org/2001/04/xmlenc#Element"><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/><dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><xenc:EncryptedKey><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/><xenc:CipherData><xenc:CipherValue>';
855-
$this->assertContains($nameidExpectedEnc, $nameIdEnc);
858+
$nameidExpectedEncId = '<saml:EncryptedID><xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"';
859+
$nameidExpectedEncData = '<xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/><dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><xenc:EncryptedKey><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/><xenc:CipherData><xenc:CipherValue>';
860+
861+
$this->assertContains($nameidExpectedEncId, $nameIdEnc);
862+
$this->assertContains($nameidExpectedEncData, $nameIdEnc);
856863

857864
// Check AES128_GCM support
858865
if (version_compare(phpversion(), '7.1.0', '>=') && in_array("aes-128-gcm", openssl_get_cipher_methods())) {
859-
$nameidExpectedEnc = '<saml:EncryptedID><xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Type="http://www.w3.org/2001/04/xmlenc#Element"><xenc:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes128-gcm"/><dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><xenc:EncryptedKey><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/><xenc:CipherData><xenc:CipherValue>';
866+
$nameidExpectedEncData = '<xenc:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes128-gcm"/><dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><xenc:EncryptedKey><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/><xenc:CipherData><xenc:CipherValue>';
860867

861868
$nameIdEnc = Utils::generateNameId(
862869
$nameIdValue,
@@ -866,7 +873,8 @@ public function testGenerateNameIdWithSPNameQualifier()
866873
null,
867874
XMLSecurityKey::AES128_GCM
868875
);
869-
$this->assertContains($nameidExpectedEnc, $nameIdEnc);
876+
$this->assertContains($nameidExpectedEncId, $nameIdEnc);
877+
$this->assertContains($nameidExpectedEncData, $nameIdEnc);
870878
}
871879
}
872880

0 commit comments

Comments
 (0)