Enforce valid setting for validateInResponseTo (#314)

node-saml · Aug 18, 2023 · cbe102a · cbe102a
1 parent 045e3b9
commit cbe102a
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 0 deletions.
diff --git a/src/saml.ts b/src/saml.ts
@@ -150,6 +150,10 @@ class SAML {
       racComparison: ctorOptions.racComparison ?? "exact",
     };
 
+    if (!Object.values(ValidateInResponseTo).includes(options.validateInResponseTo)) {
+      throw new TypeError("validateInResponseTo must be one of ['never', 'ifPresent', 'always']");
+    }
+
     /**
      * List of possible values:
      * - exact : Assertion context must exactly match a context in the list

diff --git a/test/tests.spec.ts b/test/tests.spec.ts
@@ -1946,6 +1946,34 @@ describe("node-saml /", function () {
           expect(samlObjValidComparisonType.options.racComparison).to.equal(racComparison);
         });
       });
+
+      it("should check the value of the option `validateInResponseTo`", function () {
+        expect(() => {
+          new SAML({
+            callbackUrl: "http://localhost/saml/consume",
+            validateInResponseTo: "bad_value" as ValidateInResponseTo,
+            cert: FAKE_CERT,
+            issuer: "onesaml_login",
+          }).options;
+        }).to.throw("validateInResponseTo must be one of ['never', 'ifPresent', 'always']");
+
+        const validInResponseToTypes: string[] = Object.keys(ValidateInResponseTo);
+        let samlObjValidInResponseToType: SAML;
+        validInResponseToTypes.forEach(function (validateInResponseTo) {
+          samlObjValidInResponseToType = new SAML({
+            callbackUrl: "http://localhost/saml/consume",
+            validateInResponseTo: validateInResponseTo as ValidateInResponseTo,
+            cert: FAKE_CERT,
+            issuer: "onesaml_login",
+          });
+          expect(samlObjValidInResponseToType.options.validateInResponseTo).to.equal(
+            validateInResponseTo,
+          );
+          expect(samlObjValidInResponseToType.options.validateInResponseTo).to.equal(
+            validateInResponseTo,
+          );
+        });
+      });
     });
 
     describe("getAuthorizeMessageAsync checks /", function () {