Fix DigestMethod lookup bug.

[curious-attempt-bunny]

Thanks!

Thanks for maintaining the ruby-saml library. This is a great service you're providing. It's been a while since I found a bug in ruby-saml. Here's a fix for this one. I hope you find the tests satisfactory.

Passes validation

<Signature xmlns:ds='http://www.w3.org/2000/09/xmldsig#'>
...
<ds:DigestMethod Algorithm='http://www.w3.org/2001/04/xmlenc#sha256'/>

Fails validation with a Digest Mismatch error

<Signature xmlns='http://www.w3.org/2000/09/xmldsig#'>
...
<DigestMethod Algorithm='http://www.w3.org/2001/04/xmlenc#sha256'/>

Details

This bug is masked by sha1 being the default digest_algorithm when the lookup of the DigestMethod fails.

[phene]

This test should have an assertion and not just rely on an exception not being raised.

[Lordnibbler]

can you please improve this test, @curious-attempt-bunny

[curious-attempt-bunny]

Sure thing. What about it do you want to see changed?

Am Sep 9, 2014 um 11:44 AM schrieb Ben notifications@github.com:

In test/xml_security_test.rb:

@@ -52,6 +52,12 @@ class XmlSecurityTest < Test::Unit::TestCase
assert_equal("Key validation error", exception.message)
end

• should "correctly obtain the digest method with alternate namespace declaration" do

•  document = XMLSecurity::SignedDocument.new(fixture(:adfs_response_xmlns, false))
  

•  base64cert = document.elements["//X509Certificate"].text
  

•  document.validate_signature(base64cert, false)
  

  can you please improve this test, @curious-attempt-bunny

—
Reply to this email directly or view it on GitHub.

[Lordnibbler]

can you add an actual assertion? like http://apidock.com/ruby/Test/Unit/Assertions/assert_raise

[phene]

+1 with a minor suggestion for the test.

[pitbulk]

See also #129

[Lordnibbler]

@luisvm @inakidelamadrid can you guys review? i give 👍 if the test can be improved

[cbshakumar]

I am currently running into this issue and would really like this bug fix merged.

[curious-attempt-bunny]

@phene Done.

[Lordnibbler]

@pitbulk @luisvm @inakidelamadrid @pwnetrationguru guys, can you please review this? it looks 👍 to me

[pwnetrationguru]

👍 and 💥

[pitbulk]

👍

[luisvm]

👍 looking good

[Lordnibbler]

shipping it

[Lordnibbler]

thanks for your patience @curious-attempt-bunny @cbshakumar

[curious-attempt-bunny]

Thanks for maintaining ruby-saml!

Am Sep 17, 2014 um 11:12 AM schrieb Ben notifications@github.com:

thanks for your patience @curious-attempt-bunny @cbshakumar

—
Reply to this email directly or view it on GitHub.

[Lordnibbler]

welcome @curious-attempt-bunny !