Skip to content

Commit f6227a4

Browse files
timleggetimlegge
committed
Replace remaining XML::XPath with XML::libXML
1 parent 7bddf72 commit f6227a4

File tree

8 files changed

+50
-42
lines changed

8 files changed

+50
-42
lines changed

‎lib/Net/SAML2/Binding/POST.pm‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ use strict;
44
use warnings;
55

66
use Moose;
7-
use Net::SAML2::XML::Util qw/ no_comments /;
87

98
=head1 NAME
109
@@ -57,7 +56,7 @@ sub handle_response {
5756
my ($self, $response) = @_;
5857

5958
# unpack and check the signature
60-
my $xml = no_comments(decode_base64($response));
59+
my $xml = decode_base64($response);
6160
my $xml_opts = { x509 => 1 };
6261
$xml_opts->{ cert_text } = $self->cert_text if ($self->cert_text);
6362
$xml_opts->{ exclusive } = 1;

‎lib/Net/SAML2/Binding/SOAP.pm‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -135,11 +135,7 @@ sub handle_response {
135135
my $subject = sprintf("%s (verified)", $cert->subject);
136136

137137
# parse the SOAP response and return the payload
138-
my $dom = XML::LibXML->load_xml(
139-
string => no_comments($response),
140-
no_network => 1,
141-
load_ext_dtd => 0,
142-
expand_entities => 0 );
138+
my $dom = no_comments($response);
143139

144140
my $parser = XML::LibXML::XPathContext->new($dom);
145141
$parser->registerNs('soap-env', 'http://schemas.xmlsoap.org/soap/envelope/');
@@ -160,11 +156,14 @@ Accepts a string containing the complete SOAP request.
160156
sub handle_request {
161157
my ($self, $request) = @_;
162158

163-
my $parser = XML::XPath->new( xml => no_comments($request) );
164-
$parser->set_namespace('soap-env', 'http://schemas.xmlsoap.org/soap/envelope/');
165-
$parser->set_namespace('samlp', 'urn:oasis:names:tc:SAML:2.0:protocol');
159+
my $dom = no_comments($request);
166160

167-
my $saml = $parser->findnodes_as_string('/soap-env:Envelope/soap-env:Body/*');
161+
my $parser = XML::LibXML::XPathContext->new($dom);
162+
$parser->registerNs('soap-env', 'http://schemas.xmlsoap.org/soap/envelope/');
163+
$parser->registerNs('samlp', 'urn:oasis:names:tc:SAML:2.0:protocol');
164+
165+
my ($nodes) = $parser->findnodes('/soap-env:Envelope/soap-env:Body/*');
166+
my $saml = $nodes->toString;
168167

169168
if (defined $saml) {
170169
my $x = Net::SAML2::XML::Sig->new({ x509 => 1, cert_text => $self->idp_cert, exclusive => 1, });

‎lib/Net/SAML2/IdP.pm‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ use Crypt::OpenSSL::X509;
2020
use HTTP::Request::Common;
2121
use LWP::UserAgent;
2222
use XML::LibXML;
23+
use Net::SAML2::XML::Util qw/ no_comments /;
2324

2425
=head2 new( )
2526
@@ -73,11 +74,7 @@ document.
7374
sub new_from_xml {
7475
my($class, %args) = @_;
7576

76-
my $dom = XML::LibXML->load_xml(
77-
string => $args{xml},
78-
no_network => 1,
79-
load_ext_dtd => 0,
80-
expand_entities => 0 );
77+
my $dom = no_comments($args{xml});
8178

8279
my $xpath = XML::LibXML::XPathContext->new($dom);
8380
$xpath->registerNs('md', 'urn:oasis:names:tc:SAML:2.0:metadata');

‎lib/Net/SAML2/Protocol/Assertion.pm‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -55,11 +55,7 @@ XML data
5555
sub new_from_xml {
5656
my($class, %args) = @_;
5757

58-
my $dom = XML::LibXML->load_xml(
59-
string => no_comments($args{xml}),
60-
no_network => 1,
61-
load_ext_dtd => 0,
62-
expand_entities => 0 );
58+
my $dom = no_comments($args{xml});
6359

6460
my $xpath = XML::LibXML::XPathContext->new($dom);
6561
$xpath->registerNs('saml', 'urn:oasis:names:tc:SAML:2.0:assertion');

‎lib/Net/SAML2/Protocol/LogoutRequest.pm‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -76,11 +76,7 @@ XML data
7676
sub new_from_xml {
7777
my ($class, %args) = @_;
7878

79-
my $dom = XML::LibXML->load_xml(
80-
string => no_comments($args{xml}),
81-
no_network => 1,
82-
load_ext_dtd => 0,
83-
expand_entities => 0 );
79+
my $dom = no_comments($args{xml});
8480

8581
my $xpath = XML::LibXML::XPathContext->new($dom);
8682
$xpath->registerNs('saml', 'urn:oasis:names:tc:SAML:2.0:assertion');

‎lib/Net/SAML2/Protocol/LogoutResponse.pm‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -71,18 +71,20 @@ XML data
7171
sub new_from_xml {
7272
my ($class, %args) = @_;
7373

74-
my $xpath = XML::XPath->new( xml => no_comments($args{xml}) );
75-
$xpath->set_namespace('saml', 'urn:oasis:names:tc:SAML:2.0:assertion');
76-
$xpath->set_namespace('samlp', 'urn:oasis:names:tc:SAML:2.0:protocol');
74+
my $dom = no_comments($args{xml});
75+
76+
my $xpath = XML::LibXML::XPathContext->new($dom);
77+
$xpath->registerNs('saml', 'urn:oasis:names:tc:SAML:2.0:assertion');
78+
$xpath->registerNs('samlp', 'urn:oasis:names:tc:SAML:2.0:protocol');
7779

7880
my $self = $class->new(
79-
id => $xpath->findvalue('/samlp:LogoutResponse/@ID')->value,
80-
response_to => $xpath->findvalue('/samlp:LogoutResponse/@InResponseTo')->value,
81-
destination => $xpath->findvalue('/samlp:LogoutResponse/@Destination')->value,
82-
session => $xpath->findvalue('/samlp:LogoutResponse/samlp:SessionIndex')->value,
83-
issuer => $xpath->findvalue('/samlp:LogoutResponse/saml:Issuer')->value,
84-
status => $xpath->findvalue('/samlp:LogoutResponse/samlp:Status/samlp:StatusCode/@Value')->value,
85-
substatus => $xpath->findvalue('/samlp:LogoutResponse/samlp:Status/samlp:StatusCode/samlp:StatusCode/@Value')->value,
81+
id => $xpath->findvalue('/samlp:LogoutResponse/@ID'),
82+
response_to => $xpath->findvalue('/samlp:LogoutResponse/@InResponseTo'),
83+
destination => $xpath->findvalue('/samlp:LogoutResponse/@Destination'),
84+
session => $xpath->findvalue('/samlp:LogoutResponse/samlp:SessionIndex'),
85+
issuer => $xpath->findvalue('/samlp:LogoutResponse/saml:Issuer'),
86+
status => $xpath->findvalue('/samlp:LogoutResponse/samlp:Status/samlp:StatusCode/@Value'),
87+
substatus => $xpath->findvalue('/samlp:LogoutResponse/samlp:Status/samlp:StatusCode/samlp:StatusCode/@Value'),
8688
);
8789

8890
return $self;

‎lib/Net/SAML2/XML/Sig.pm‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,7 @@ use base qw/Exporter/;
7373

7474
use Digest::SHA qw(sha1 sha224 sha256 sha384 sha512);
7575
use XML::LibXML;
76+
use Net::SAML2::XML::Util qw/ no_comments /;
7677
use MIME::Base64;
7778
use Carp;
7879

@@ -288,7 +289,12 @@ sub sign {
288289

289290
local $XML::LibXML::skipXMLDeclaration = $self->{ no_xml_declaration };
290291

291-
my $dom = XML::LibXML->load_xml( string => $xml );
292+
my $dom = no_comments($xml);
293+
#my $dom = XML::LibXML->load_xml(
294+
# string => $xml,
295+
# no_network => 1,
296+
# load_ext_dtd => 0,
297+
# expand_entities => 0 );
292298

293299
$self->{ parser } = XML::LibXML::XPathContext->new($dom);
294300
$self->{ parser }->registerNs('dsig', 'http://www.w3.org/2000/09/xmldsig#');
@@ -451,7 +457,12 @@ sub verify {
451457
delete $self->{signer_cert};
452458
my ($xml) = @_;
453459

454-
my $dom = XML::LibXML->load_xml( string => $xml );
460+
my $dom = no_comments($xml);
461+
#my $dom = XML::LibXML->load_xml(
462+
# string => $xml,
463+
# no_network => 1,
464+
# load_ext_dtd => 0,
465+
# expand_entities => 0 );
455466

456467
$self->{ parser } = XML::LibXML::XPathContext->new($dom);
457468
$self->{ parser }->registerNs('dsig', 'http://www.w3.org/2000/09/xmldsig#');

‎lib/Net/SAML2/XML/Util.pm‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ package Net::SAML2::XML::Util;
33
use strict;
44
use warnings;
55

6-
use XML::Tidy;
6+
use XML::LibXML;
77

88
# use 'our' on v5.6.0
99
use vars qw($VERSION @EXPORT_OK %EXPORT_TAGS $DEBUG);
@@ -42,9 +42,17 @@ sub no_comments {
4242
my $xml = shift;
4343

4444
# Remove comments from XML to mitigate XML comment auth bypass
45-
my $tidy_obj = XML::Tidy->new(xml => $xml);
46-
$tidy_obj->prune('//comment()');
47-
return $tidy_obj->toString();
45+
my $dom = XML::LibXML->load_xml(
46+
string => $xml,
47+
no_network => 1,
48+
load_ext_dtd => 0,
49+
expand_entities => 0 );
50+
51+
for my $comment_node ($dom->findnodes('//comment()')) {
52+
$comment_node->parentNode->removeChild($comment_node);
53+
}
54+
55+
return $dom;
4856
}
4957

5058
1;

0 commit comments

Comments
 (0)