samlify - npm Package Compare versions

Comparing version 2.5.0-rc1 to 2.5.0-rc2

build/src/binding-post.js

@@ -7,9 +7,12 @@ "use strict";
 */
-var __assign = (this && this.__assign) || Object.assign || function(t) {
-    for (var s, i = 1, n = arguments.length; i < n; i++) {
-        s = arguments[i];
-        for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
-            t[p] = s[p];
-    }
-    return t;
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
 };
@@ -191,5 +194,5 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
                         // console.debug('sp wants assertion signed');
-                        rawSamlResponse = libsaml_1.default.constructSAMLSignature(__assign({}, config, { rawSamlMessage: rawSamlResponse, referenceTagXPath: '/samlp:Response/saml:Assertion', signatureConfig: {
+                        rawSamlResponse = libsaml_1.default.constructSAMLSignature(__assign({}, config, { rawSamlMessage: rawSamlResponse, referenceTagXPath: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']", signatureConfig: {
                                 prefix: 'ds',
-                                location: { reference: '/samlp:Response/saml:Assertion/saml:Issuer', action: 'after' },
+                                location: { reference: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']/*[local-name(.)='Issuer']", action: 'after' },
                             } }));
@@ -203,3 +206,3 @@ }
                                 prefix: 'ds',
-                                location: { reference: '/samlp:Response/saml:Issuer', action: 'after' },
+                                location: { reference: "/*[local-name(.)='Response']/*[local-name(.)='Issuer']", action: 'after' },
                             } }));
@@ -224,3 +227,3 @@ }
                                 prefix: 'ds',
-                                location: { reference: '/samlp:Response/saml:Issuer', action: 'after' },
+                                location: { reference: "/*[local-name(.)='Response']/*[local-name(.)='Issuer']", action: 'after' },
                             } }));
@@ -227,0 +230,0 @@ }

build/src/entity-idp.js

 "use strict";
 var __extends = (this && this.__extends) || (function () {
-    var extendStatics = Object.setPrototypeOf ||
-        ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
-        function (d, b) { for (var p in b) if (b.hasOwnProperty(p)) d[p] = b[p]; };
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (b.hasOwnProperty(p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
     return function (d, b) {
@@ -12,9 +15,12 @@ extendStatics(d, b);
 })();
-var __assign = (this && this.__assign) || Object.assign || function(t) {
-    for (var s, i = 1, n = arguments.length; i < n; i++) {
-        s = arguments[i];
-        for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
-            t[p] = s[p];
-    }
-    return t;
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
 };
@@ -21,0 +27,0 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {

build/src/entity-sp.js

 "use strict";
 var __extends = (this && this.__extends) || (function () {
-    var extendStatics = Object.setPrototypeOf ||
-        ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
-        function (d, b) { for (var p in b) if (b.hasOwnProperty(p)) d[p] = b[p]; };
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (b.hasOwnProperty(p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
     return function (d, b) {
@@ -12,9 +15,12 @@ extendStatics(d, b);
 })();
-var __assign = (this && this.__assign) || Object.assign || function(t) {
-    for (var s, i = 1, n = arguments.length; i < n; i++) {
-        s = arguments[i];
-        for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
-            t[p] = s[p];
-    }
-    return t;
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
 };
@@ -21,0 +27,0 @@ Object.defineProperty(exports, "__esModule", { value: true });

build/src/entity.js

 "use strict";
-var __assign = (this && this.__assign) || Object.assign || function(t) {
-    for (var s, i = 1, n = arguments.length; i < n; i++) {
-        s = arguments[i];
-        for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
-            t[p] = s[p];
-    }
-    return t;
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
 };
@@ -10,0 +13,0 @@ Object.defineProperty(exports, "__esModule", { value: true });

build/src/extractor.js

 "use strict";
-var __assign = (this && this.__assign) || Object.assign || function(t) {
-    for (var s, i = 1, n = arguments.length; i < n; i++) {
-        s = arguments[i];
-        for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
-            t[p] = s[p];
-    }
-    return t;
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
 };
@@ -10,0 +13,0 @@ Object.defineProperty(exports, "__esModule", { value: true });

build/src/metadata-idp.js

 "use strict";
 var __extends = (this && this.__extends) || (function () {
-    var extendStatics = Object.setPrototypeOf ||
-        ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
-        function (d, b) { for (var p in b) if (b.hasOwnProperty(p)) d[p] = b[p]; };
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (b.hasOwnProperty(p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
     return function (d, b) {
@@ -7,0 +10,0 @@ extendStatics(d, b);

build/src/metadata-sp.js

 "use strict";
 var __extends = (this && this.__extends) || (function () {
-    var extendStatics = Object.setPrototypeOf ||
-        ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
-        function (d, b) { for (var p in b) if (b.hasOwnProperty(p)) d[p] = b[p]; };
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (b.hasOwnProperty(p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
     return function (d, b) {
@@ -7,0 +10,0 @@ extendStatics(d, b);

build/src/schema-validator.js

@@ -45,2 +45,3 @@ "use strict";
     SchemaValidators["LIBXML"] = "libxml-xsd";
+    SchemaValidators["XMLLINT"] = "node-xmllint";
 })(SchemaValidators || (SchemaValidators = {}));
@@ -57,7 +58,9 @@ var moduleResolver = function (name) {
 var getValidatorModule = function () { return __awaiter(_this, void 0, void 0, function () {
-    var selectedValidator, xsd, setSchemaDir, validator, mod_1, mod_2;
+    var selectedValidator, xsd, setSchemaDir, validator, mod_1, mod_2, mod_3, schemaPath, schemaProto_1, schemaAssert_1, schemaXmldsig_1, schemaXenc_1;
     return __generator(this, function (_a) {
         switch (_a.label) {
             case 0:
-                selectedValidator = moduleResolver(SchemaValidators.JAVAC) || moduleResolver(SchemaValidators.LIBXML);
+                selectedValidator = moduleResolver(SchemaValidators.JAVAC)
+                    || moduleResolver(SchemaValidators.LIBXML)
+                    || moduleResolver(SchemaValidators.XMLLINT);
                 xsd = 'saml-schema-protocol-2.0.xsd';
@@ -135,2 +138,33 @@ if (!(selectedValidator === SchemaValidators.JAVAC)) return [3 /*break*/, 2];
             case 4:
+                if (!(selectedValidator === SchemaValidators.XMLLINT)) return [3 /*break*/, 6];
+                return [4 /*yield*/, Promise.resolve().then(function () { return require(SchemaValidators.XMLLINT); })];
+            case 5:
+                mod_3 = _a.sent();
+                schemaPath = function (schema) { return path.resolve(__dirname, "../schemas/" + schema); };
+                schemaProto_1 = fs.readFileSync(schemaPath(xsd), 'utf-8');
+                schemaAssert_1 = fs.readFileSync(schemaPath('saml-schema-assertion-2.0.xsd'), 'utf-8');
+                schemaXmldsig_1 = fs.readFileSync(schemaPath('xmldsig-core-schema.xsd'), 'utf-8');
+                schemaXenc_1 = fs.readFileSync(schemaPath('xenc-schema.xsd'), 'utf-8');
+                // file fix for virtual filesystem of emscripten
+                schemaProto_1 = schemaProto_1.replace('saml-schema-assertion-2.0.xsd', 'file_0.xsd');
+                schemaProto_1 = schemaProto_1.replace('xmldsig-core-schema.xsd', 'file_1.xsd');
+                schemaAssert_1 = schemaAssert_1.replace('xmldsig-core-schema.xsd', 'file_1.xsd');
+                schemaAssert_1 = schemaAssert_1.replace('xenc-schema.xsd', 'file_2.xsd');
+                schemaXenc_1 = schemaXenc_1.replace('xmldsig-core-schema.xsd', 'file_1.xsd');
+                return [2 /*return*/, {
+                        validate: function (xml) {
+                            return new Promise(function (resolve, reject) {
+                                var validationResult = mod_3.validateXML({
+                                    xml: xml,
+                                    schema: [schemaAssert_1, schemaXmldsig_1, schemaXenc_1, schemaProto_1]
+                                });
+                                if (!validationResult.errors) {
+                                    return resolve('SUCCESS_VALIDATE_XML');
+                                }
+                                console.error("this is not a valid saml response with errors: " + validationResult.errors);
+                                return reject('ERR_EXCEPTION_VALIDATE_XML');
+                            });
+                        }
+                    }];
+            case 6:
                 // allow to skip the validate function if it's in development or test mode if no schema validator is provided
@@ -137,0 +171,0 @@ if (process.env.NODE_ENV === 'dev' || process.env.NODE_ENV === 'test') {

build/src/validator.js

@@ -8,12 +8,14 @@ "use strict";
     }
+    var notBeforeLocal = null;
+    var notOnOrAfterLocal = null;
     if (utcNotBefore && !utcNotOnOrAfter) {
-        var notBeforeLocal_1 = new Date(utcNotBefore);
-        return +notBeforeLocal_1 <= +now;
+        notBeforeLocal = new Date(utcNotBefore);
+        return +notBeforeLocal <= +now;
     }
     if (!utcNotBefore && utcNotOnOrAfter) {
-        var notOnOrAfterLocal_1 = new Date(utcNotOnOrAfter);
-        return now < notOnOrAfterLocal_1;
+        notOnOrAfterLocal = new Date(utcNotOnOrAfter);
+        return now < notOnOrAfterLocal;
     }
-    var notBeforeLocal = new Date(utcNotBefore);
-    var notOnOrAfterLocal = new Date(utcNotOnOrAfter);
+    notBeforeLocal = new Date(utcNotBefore);
+    notOnOrAfterLocal = new Date(utcNotOnOrAfter);
     return +notBeforeLocal <= +now && now < notOnOrAfterLocal;
@@ -20,0 +22,0 @@ }

package.json

 {
   "name": "samlify",
-  "version": "2.5.0-rc1",
+  "version": "2.5.0-rc2",
   "description": "High-level API for Single Sign On (SAML 2.0)",
@@ -43,3 +43,3 @@ "main": "build/index.js",
     "xml": "^1.0.0",
-    "xml-crypto": "^1.0.1",
+    "xml-crypto": "^1.1.4",
     "xmldom": "^0.1.19",
@@ -54,8 +54,8 @@ "xpath": "^0.0.27"
     "@types/xmldom": "^0.1.28",
-    "ava": "^0.19.1",
+    "ava": "^1.2.1",
     "coveralls": "^3.0.2",
     "nyc": "^11.9.0",
-    "tslint": "5.4.2",
-    "typescript": "^2.9.2"
+    "tslint": "^5.12.1",
+    "typescript": "^3.3.3333"
   }
 }

src/binding-post.ts

@@ -144,6 +144,6 @@ /**
         rawSamlMessage: rawSamlResponse,
-        referenceTagXPath: '/samlp:Response/saml:Assertion', 
+        referenceTagXPath: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']", 
         signatureConfig: {
           prefix: 'ds',
-          location: { reference: '/samlp:Response/saml:Assertion/saml:Issuer', action: 'after' },
+          location: { reference: "/*[local-name(.)='Response']/*[local-name(.)='Assertion']/*[local-name(.)='Issuer']", action: 'after' },
         },
@@ -165,3 +165,3 @@ });
           prefix: 'ds',
-          location: { reference: '/samlp:Response/saml:Issuer', action: 'after' },
+          location: { reference: "/*[local-name(.)='Response']/*[local-name(.)='Issuer']", action: 'after' },
         },
@@ -193,3 +193,3 @@ });
           prefix: 'ds',
-          location: { reference: '/samlp:Response/saml:Issuer', action: 'after' },
+          location: { reference: "/*[local-name(.)='Response']/*[local-name(.)='Issuer']", action: 'after' },
         },
@@ -196,0 +196,0 @@ });

src/schema-validator.ts

@@ -6,3 +6,4 @@ import * as fs from 'fs';
   JAVAC = '@passify/xsd-schema-validator',
-  LIBXML = 'libxml-xsd'
+  LIBXML = 'libxml-xsd',
+  XMLLINT = 'node-xmllint'
 }
@@ -27,3 +28,5 @@
 
-  const selectedValidator: string = moduleResolver(SchemaValidators.JAVAC) || moduleResolver(SchemaValidators.LIBXML);
+  const selectedValidator: string = moduleResolver(SchemaValidators.JAVAC)
+    || moduleResolver(SchemaValidators.LIBXML)
+    || moduleResolver(SchemaValidators.XMLLINT);
 
@@ -103,2 +106,42 @@ const xsd = 'saml-schema-protocol-2.0.xsd';
 
+  if (selectedValidator === SchemaValidators.XMLLINT) {
+
+    const mod = await import (SchemaValidators.XMLLINT);
+
+    const schemaPath = (schema: string) => path.resolve(__dirname, `../schemas/${schema}`);
+
+    let schemaProto = fs.readFileSync(schemaPath(xsd), 'utf-8');
+    let schemaAssert = fs.readFileSync(schemaPath('saml-schema-assertion-2.0.xsd'), 'utf-8');
+    const schemaXmldsig = fs.readFileSync(schemaPath('xmldsig-core-schema.xsd'), 'utf-8');
+    let schemaXenc = fs.readFileSync(schemaPath('xenc-schema.xsd'), 'utf-8');
+
+    // file fix for virtual filesystem of emscripten
+    schemaProto = schemaProto.replace('saml-schema-assertion-2.0.xsd', 'file_0.xsd');
+    schemaProto = schemaProto.replace('xmldsig-core-schema.xsd', 'file_1.xsd');
+    schemaAssert = schemaAssert.replace('xmldsig-core-schema.xsd', 'file_1.xsd');
+    schemaAssert = schemaAssert.replace('xenc-schema.xsd', 'file_2.xsd');
+    schemaXenc = schemaXenc.replace('xmldsig-core-schema.xsd', 'file_1.xsd');
+
+    return {
+      validate: (xml: string) => {
+
+        return new Promise((resolve, reject) => {
+
+          const validationResult = mod.validateXML({
+            xml: xml,
+            schema: [schemaAssert, schemaXmldsig, schemaXenc, schemaProto]
+          });
+
+          if (!validationResult.errors) {
+            return resolve('SUCCESS_VALIDATE_XML');
+          }
+
+          console.error(`this is not a valid saml response with errors: ${validationResult.errors}`);
+          return reject('ERR_EXCEPTION_VALIDATE_XML');
+
+        });
+      }
+    };
+  }
+
   // allow to skip the validate function if it's in development or test mode if no schema validator is provided
@@ -105,0 +148,0 @@ if (process.env.NODE_ENV === 'dev' || process.env.NODE_ENV === 'test') {

src/validator.ts

@@ -7,13 +7,17 @@ function verifyTime(utcNotBefore?: string, utcNotOnOrAfter?: string): boolean {
   }
+
+  let notBeforeLocal = null;
+  let notOnOrAfterLocal = null;
+
   if (utcNotBefore && !utcNotOnOrAfter) {
-    const notBeforeLocal = new Date(utcNotBefore);
+    notBeforeLocal = new Date(utcNotBefore);
     return +notBeforeLocal <= +now;
   }
   if (!utcNotBefore && utcNotOnOrAfter) {
-    const notOnOrAfterLocal = new Date(utcNotOnOrAfter);
+    notOnOrAfterLocal = new Date(utcNotOnOrAfter);
     return now < notOnOrAfterLocal;
   }
 
-  const notBeforeLocal = new Date(utcNotBefore);
-  const notOnOrAfterLocal = new Date(utcNotOnOrAfter);
+  notBeforeLocal = new Date(utcNotBefore);
+  notOnOrAfterLocal = new Date(utcNotOnOrAfter);
   return +notBeforeLocal <= +now && now < notOnOrAfterLocal;
@@ -20,0 +24,0 @@ }

tslint.json

 {
     "extends": "tslint:recommended",
     "rulesDirectory": [],
+    "linterOptions": {
+      "exclude": [
+        "node_modules/**"
+      ]
+    },
     "rules": {
@@ -5,0 +10,0 @@ "arrow-parens": [true, "ban-single-arg-parens"],

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

526371

increased by1.37%

Lines of code

7433

increased by1.39%

Worsened metrics

Number of low supply chain risk alerts

10

increased by11.11%

Dependency changes

• Updatedxml-crypto@^1.1.4