ls-29145 merge upstream #13

mattcobb · 2022-04-28T04:54:25Z

Sink with upstream saml to get fix for vuln CVE-2020-7711 in goxmldsig

…g a metadata file with multiple EntityDescriptor's underneath a EntitiesDescriptor tag

Add syntax highlight

* Enable persistent name id format

@RichardKnop

…am#117) @RichardKnop PR#94

…crewjam#116)

* use dep package manager * updated travis

fixes crewjam#123

…m the assertion (crewjam#130) fixes crewjam#122 jwt-go not support leeway parameter

… context (crewjam#131)

…ewjam#133) We’ve had a bunch of changes requesting the ability to customize how cookies are set and it is getting a little messy. This change moves the code to setting and reading cookies into two interfaces which you can extend/customize.

…nt” time (crewjam#136) The default is obviously the current time, but for various reasons you may wish to evaluate the response at a different reference time, for example processing a response that has been deferred. We can’t use the global TimeNow() thunk, which is designed for testing, because it isn’t safe to modify concurrently.

ref: CVE-2017-11427 ref: CVE-2017-11428 ref: CVE-2017-11429 ref: CVE-2017-11430 ref: CVE-2018-0489 ref: CVE-2018-7340 ref: https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations

… does not reset the default. Should resolve the test for issue 152. (crewjam#158)

fixes crewjam#333

* upgrade golang.org/x/crypto from v0.0.0-20210317152858-513c2a44f670 to v0.0.0-20210322153248-0c34fe9e7dc2 Co-authored-by: Github Actions <[email protected]>

Co-authored-by: crewjam <[email protected]>

…wjam#344) * Change dgrijalva/jwt-go imported module to form3tech-oss/jwt-go. dgrijalva/jwt-go is abandoned (dgrijalva/jwt-go#457) with an outstanding security vulnerability (dgrijalva/jwt-go#422). form3tech-oss/jwt-go is a fork that has fixed the vulnerability.

Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>

@simmel

From https://www.oasis-open.org/committees/download.php/56785/sstc-saml-metadata-errata-2.0-wd-05.pdf ``` [E62]A use value of "signing" means that the contained key information is applicable to both signing and TLS/SSL operations performed by the entity when acting in the enclosing role. A use value of "encryption" means that the contained key information is suitable for use in wrapping encryption keys for use by the entity when acting in the enclosing role. If the use attribute is omitted, then the contained key information is applicable to both of the above uses. ``` We need to include certificates both when they have a "use" attribute of "signing" as well as when the "use" attribute is missing. Fixes crewjam#352 SAML input from @simmel.

…jwt/v4 (crewjam#383) * Switch from github.com/form3tech-oss/jwt-go to github.com/golang-jwt/jwt/v4 * Fix tests for Go 1.17 and update CI accordingly

* add /logout to initiate SLO request * fix * unused package * gofmt-ed

…020-7711 (crewjam#391)

* Add support for aes128-gcm algorithm * Pass nonce to encrypt function and add some tests

* Implemented SP support for receiving authentication results via artifact binding. * update test expectations Co-authored-by: David Venhoek <[email protected]>

Bumps [github.com/google/go-cmp](https://github.com/google/go-cmp) from 0.5.5 to 0.5.6. - [Release notes](https://github.com/google/go-cmp/releases) - [Commits](google/go-cmp@v0.5.5...v0.5.6) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Support multiple X509Certificate elements in X509Data * Update test files * Remove unnecessary comments * add comments Co-authored-by: Alexander Zobnin <[email protected]>

Bumps [github.com/golang-jwt/jwt/v4](https://github.com/golang-jwt/jwt) from 4.1.0 to 4.2.0. - [Release notes](https://github.com/golang-jwt/jwt/releases) - [Changelog](https://github.com/golang-jwt/jwt/blob/main/VERSION_HISTORY.md) - [Commits](golang-jwt/jwt@v4.1.0...v4.2.0) --- updated-dependencies: - dependency-name: github.com/golang-jwt/jwt/v4 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* upgrade golang.org/x/crypto from v0.0.0-20210322153248-0c34fe9e7dc2 to v0.0.0-20211215153901-e495a2d5b3d3 Co-authored-by: Github Actions <[email protected]>

Resolves crewjam#406

Bumps [github.com/google/go-cmp](https://github.com/google/go-cmp) from 0.5.6 to 0.5.7. - [Release notes](https://github.com/google/go-cmp/releases) - [Commits](google/go-cmp@v0.5.6...v0.5.7) --- updated-dependencies: - dependency-name: github.com/google/go-cmp dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* upgrade golang.org/x/crypto from v0.0.0-20211215153901-e495a2d5b3d3 to v0.0.0-20220128200615-198e4374d7ed Co-authored-by: Github Actions <[email protected]>

Bumps [github.com/golang-jwt/jwt/v4](https://github.com/golang-jwt/jwt) from 4.2.0 to 4.4.1. - [Release notes](https://github.com/golang-jwt/jwt/releases) - [Changelog](https://github.com/golang-jwt/jwt/blob/main/VERSION_HISTORY.md) - [Commits](golang-jwt/jwt@v4.2.0...v4.4.1) --- updated-dependencies: - dependency-name: github.com/golang-jwt/jwt/v4 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Allow to specify HTTPClient for SAML artifact resolution * go fmt

…am#415) * Fix ArtifactResolveElement and add tests * goimports

Donald Hoelle and others added 30 commits June 15, 2017 17:28

bugfix: New sometimes selected the wrong EntityDescriptor when parsin…

9b49e7d

…g a metadata file with multiple EntityDescriptor's underneath a EntitiesDescriptor tag

Add syntax highlight

6ab3142

expose CookieMaxAge in samlsp Options

aa4e43f

Merge pull request crewjam#96 from umayr/master

9477cf4

Add syntax highlight

Enable persistent name id format (crewjam#107)

aa1c598

* Enable persistent name id format

Merge branch 'pr90'

54c5d5a

Merge branch 'pr115'

a6e02ca

add ability to set the domain for the cookies (crewjam#95)

56801ab

Fixed script hash to remove JS console errors when redirecting (crewj…

50777a1

…am#117) @RichardKnop PR#94

saml{sp,idp}: add httpOnly and secure flag (conditionally) to cookies (…

bb12e77

…crewjam#116)

Use dep package manager (crewjam#114)

5098b49

* use dep package manager * updated travis

Fix example code so that it compiles (crewjam#118)

febc398

expose ForceAuthn (crewjam#119)

5e89d54

fix validUntil in SPSSODescriptor

bbf4ae9

fixes crewjam#123

samlsp.Middleware.SecureCookie option (crewjam#128)

61c0584

remove cruft

90a8ae8

update README

f33bc82

fix some minor lint / style errors

b1cfb79

samlsp: use current time for the JWT rather than the IssueInstant fro…

804bf46

…m the assertion (crewjam#130) fixes crewjam#122 jwt-go not support leeway parameter

travis cleanup: remove older go versions (crewjam#132)

e9d713d

samlsp: remove X-Saml headers in favor of attaching Claims to request…

c9c2cbc

… context (crewjam#131)

idp: handle assertions where no ACS url is specified (crewjam#139)

794aa92

add test cases for SAML comment injection (crewjam#140)

814d1d9

ref: CVE-2017-11427 ref: CVE-2017-11428 ref: CVE-2017-11429 ref: CVE-2017-11430 ref: CVE-2018-0489 ref: CVE-2018-7340 ref: https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations

Update PGP key in README.md

e231b7a

make MaxIssueDelay configurable at runtime (mini-hack)

d6cac45

Remove the default xmlns from the expected output because the encoder…

eefba21

… does not reset the default. Should resolve the test for issue 152. (crewjam#158)

Added Travis badge (crewjam#159)

8f169cc

Fixed some typos in the README.md file. (crewjam#160)

61e52e7

crewjam and others added 28 commits March 25, 2021 09:31

update README (crewjam#340)

c090542

fixes crewjam#333

Update go.mod (crewjam#342)

bd15f54

* upgrade golang.org/x/crypto from v0.0.0-20210317152858-513c2a44f670 to v0.0.0-20210322153248-0c34fe9e7dc2 Co-authored-by: Github Actions <[email protected]>

Update go.mod (crewjam#343)

af97bd2

Co-authored-by: crewjam <[email protected]>

Upgrade to GitHub-native Dependabot (crewjam#346)

b115a40

Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>

Switch from github.com/form3tech-oss/jwt-go to github.com/golang-jwt/…

d321463

…jwt/v4 (crewjam#383) * Switch from github.com/form3tech-oss/jwt-go to github.com/golang-jwt/jwt/v4 * Fix tests for Go 1.17 and update CI accordingly

Add the NotOnOrAfter optional attribute to <LogoutRequest> (crewjam#386)

324aadd

Updated the trivial example to handle a basic logout flow (crewjam#382)

23acdd2

* add /logout to initiate SLO request * fix * unused package * gofmt-ed

Update github.com/russellhaering/goxmldsig to v1.1.1 to address CVE-2…

9627427

…020-7711 (crewjam#391)

Service Provider support for aes128-gcm algorithm (crewjam#371)

2db94e7

* Add support for aes128-gcm algorithm * Pass nonce to encrypt function and add some tests

Add XMLName field and xml tags to StatusMessage struct (crewjam#374)

0771d8f

added option defaultRedirectURI (crewjam#366)

d5716f6

artifact binding (crewjam#397)

71e1cdc

* Implemented SP support for receiving authentication results via artifact binding. * update test expectations Co-authored-by: David Venhoek <[email protected]>

make linter happy (crewjam#398)

cc1e81b

metadata cert chain (crewjam#399)

60a32b3

* Support multiple X509Certificate elements in X509Data * Update test files * Remove unnecessary comments * add comments Co-authored-by: Alexander Zobnin <[email protected]>

Update go.mod (crewjam#403)

c81ab81

* upgrade golang.org/x/crypto from v0.0.0-20210322153248-0c34fe9e7dc2 to v0.0.0-20211215153901-e495a2d5b3d3 Co-authored-by: Github Actions <[email protected]>

Move example packages to their own go module (crewjam#407)

e007e41

Resolves crewjam#406

Update go.mod (crewjam#409)

34d0298

* upgrade golang.org/x/crypto from v0.0.0-20211215153901-e495a2d5b3d3 to v0.0.0-20220128200615-198e4374d7ed Co-authored-by: Github Actions <[email protected]>

Allow to specify HTTPClient for SAML artifact resolution (crewjam#416)

224026c

* Allow to specify HTTPClient for SAML artifact resolution * go fmt

Fix ArtifactResolve element and add tests for artifact binding (crewj…

d4ed82f

…am#415) * Fix ArtifactResolveElement and add tests * goimports

Fix: not enough arguments to call TransformExcC14n (crewjam#428)

00a79cc

merge with upstream crewjam saml

013b833

fix merge errors and put back aud as array

a90b6be

mattcobb changed the title ~~ls-29145 goxmldsig vuln CVE-2020-7711~~ ls-29145 merge upstream and fix goxmldsig vuln CVE-2020-7711 Apr 29, 2022

mattcobb changed the title ~~ls-29145 merge upstream and fix goxmldsig vuln CVE-2020-7711~~ ls-29145 merge upstream Apr 29, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

ls-29145 merge upstream #13

ls-29145 merge upstream #13

Uh oh!

mattcobb commented Apr 28, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

61 participants

Uh oh!

ls-29145 merge upstream #13

Are you sure you want to change the base?

ls-29145 merge upstream #13

Uh oh!

Conversation

mattcobb commented Apr 28, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

61 participants