Add invalid params error handling for Saml::Bindings::HTTPPost.receive_message

lib/saml.rb

@@ -34,6 +34,8 @@ class InvalidProvider < SamlError
     end
     class UnparseableMessage < SamlError
     end
+    class InvalidParams < SamlError
+    end
     class MetadataDownloadFailed < SamlError
     end
     class InvalidStore < SamlError

lib/saml/bindings/http_post.rb

@@ -20,7 +20,12 @@ def create_form_attributes(message, options = {})
         end
 
         def receive_message(request, type)
-          message             = Saml::Encoding.decode_64(request.params["SAMLRequest"] || request.params["SAMLResponse"])
+          receive_xml = request.params["SAMLRequest"] || request.params["SAMLResponse"]
+          if receive_xml.nil?
+            raise Saml::Errors::InvalidParams, 'require params `SAMLRequest` or `SAMLResponse`'
+          end
+
+          message             = Saml::Encoding.decode_64(receive_xml)
           notify('receive_message', message)
           request_or_response = Saml.parse_message(message, type)
 

spec/lib/saml/bindings/http_post_spec.rb

@@ -69,5 +69,14 @@
         message
       }.to notify_with('receive_message')
     end
+
+    context 'When both `SAMLRequest` and `SAMLResponse` is nil in request params' do
+      let(:request) { double(:request, params: {}, url: "https://sp.example.com/sso") }
+      let(:message) { described_class.receive_message(request, :response) }
+
+      it 'Raise Saml::Errors::InvalidParams' do
+        expect { message }.to raise_error(Saml::Errors::InvalidParams, 'require params `SAMLRequest` or `SAMLResponse`')
+      end
+    end
   end
 end