feat(metadata): SAML metadata decoder with health checks#107
Merged
Conversation
Add a third decode path alongside SAML messages and JWTs: paste an EntityDescriptor (or a single entity from an EntitiesDescriptor aggregate) and get a structured, annotated view. - metadata.ts: pure-DOM parser for entity ID, roles (IdP/SP), certs, SSO/SLO/ACS endpoints, NameID formats, shibmd:Scope, requested attributes, MDUI, organization, contacts, registration authority, and entity categories. Reuses cert.ts and the attribute registry. - metadata-checks.ts: static health checks detectable from one document — validUntil expiry, weak (SHA-1) signature algorithm, PEM-armored certs, missing signing certs, plaintext endpoints, entityID hygiene, misspelled category URIs, and legacy SAML 1.x. Signature presence is reported independently (signed/unsigned) and is explicitly NOT verified. - Colour-coded, spec-linked entity-category badges with pattern-based classification for the long tail; binding labels incl. legacy bindings. - +page.svelte: detection routing, health-checks panel, signature status row, and a full metadata results panel; EntityDescriptor added to the input placeholder and two metadata examples to the Examples menu. - 100% test coverage across the new modules.
Read the package version at build time (kit.version.name) and show it between the Security and Source links in the footer, linking to the matching GitHub release tag. release-please bumps package.json on each release, so this updates automatically with every deploy.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
CodeQL flagged the prolog/comment-skipping regex (js/redos): the (?:<!--[\s\S]*?-->\s*)* group backtracks exponentially on inputs starting with "<!--" and containing many "--><!--" repetitions. Replace the single regex with a linear index-based scan that skips an optional BOM, XML prolog, and any leading comments, then matches only the first-element name with a simple anchored regex (no nested quantifiers). Adds a ReDoS payload test plus BOM and unterminated-prolog/comment cases.
The pinned v6.0.0 action fails at the Codecov CLI GPG signature step
("no valid OpenPGP data found" / "Can't check signature: No public key"),
blocking the Build & Test job. Per the v7.0.0 release notes, Codecov's old
`codecovsecurity` keybase account had key-migration issues and was deleted
in favour of `codecovsecops`; v7.0.0 fetches the GPG key from the working
account. (v6.0.2 is the same commit, published as a non-major copy.)
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.