PR #32 added saml_verified_identity_is_signed and wired it into saml_binding_post_verify (src/binding.c). saml_verify_doc is exported to Lua on its own as verify_doc (src/lua_saml.c), and it verifies the first <ds:Signature> in the document without checking that the reference covers the assertion the identity is later read from.
A caller doing saml.verify_doc(...) followed by saml.doc_name_id(...) is therefore still open to signature wrapping. The bundled lua/resty/saml.lua goes through binding_post_parse, so it is unaffected.
Options:
- run the coverage check inside
saml_verify_doc, so every caller inherits it,
- or document
verify_doc as a low-level primitive that does not bind identity, and point users at binding_post_parse.
The first is safer. It needs a look at whether any caller verifies documents that are not protocol messages, since the check returns early for a non-Response root.
PR #32 added
saml_verified_identity_is_signedand wired it intosaml_binding_post_verify(src/binding.c).saml_verify_docis exported to Lua on its own asverify_doc(src/lua_saml.c), and it verifies the first<ds:Signature>in the document without checking that the reference covers the assertion the identity is later read from.A caller doing
saml.verify_doc(...)followed bysaml.doc_name_id(...)is therefore still open to signature wrapping. The bundledlua/resty/saml.luagoes throughbinding_post_parse, so it is unaffected.Options:
saml_verify_doc, so every caller inherits it,verify_docas a low-level primitive that does not bind identity, and point users atbinding_post_parse.The first is safer. It needs a look at whether any caller verifies documents that are not protocol messages, since the check returns early for a non-
Responseroot.