From f733b10a280d216636e9230768e46697b35783f7 Mon Sep 17 00:00:00 2001 From: enriquepablo Date: Wed, 27 Nov 2024 13:57:07 +0100 Subject: [PATCH 1/2] Do not crash when entity-selection-profile attribute has invalid JSON --- src/pyff/samlmd.py | 19 ++- .../metadata/test-sp-trustinfo-in-attr.xml | 112 ++++++++++++++++++ 2 files changed, 127 insertions(+), 4 deletions(-) diff --git a/src/pyff/samlmd.py b/src/pyff/samlmd.py index 9be47176..c6f445b3 100644 --- a/src/pyff/samlmd.py +++ b/src/pyff/samlmd.py @@ -1047,14 +1047,25 @@ def discojson_sp_attr(e): if b64_trustinfos is None: return None + entityID = e.get('entityID', None) + if entityID is None: + return None + sp = {} - sp['entityID'] = e.get('entityID', None) + sp['entityID'] = entityID sp['profiles'] = {} for b64_trustinfo in b64_trustinfos: - str_trustinfo = b64decode(b64_trustinfo.encode('ascii')) - trustinfo = json.loads(str_trustinfo.decode('utf8')) - sp['profiles'].update(trustinfo['profiles']) + try: + str_trustinfo = b64decode(b64_trustinfo.encode('ascii')) + trustinfo = json.loads(str_trustinfo.decode('utf8')) + sp['profiles'].update(trustinfo['profiles']) + + except Exception as e: + log.warning(f"Invalid entity-selection-profile attribute for {entityID}: {e}") + + if not sp['profiles']: + return None return sp diff --git a/src/pyff/test/data/metadata/test-sp-trustinfo-in-attr.xml b/src/pyff/test/data/metadata/test-sp-trustinfo-in-attr.xml index b1532fda..12e0d268 100644 --- a/src/pyff/test/data/metadata/test-sp-trustinfo-in-attr.xml +++ b/src/pyff/test/data/metadata/test-sp-trustinfo-in-attr.xml @@ -71,6 +71,118 @@ fMou5aW0mZ+QgJNKOrxY5vFxUq6pn3OiYbBu3m1C9ajbU/nx2evzt4+qUwTfHFb+ ZgXpOtmxRekFzVvGZ18BSPJKwAAqqZ11X7skT/NwEAhbgplVPv9WkDmDzqNvHqQJ nyRgD2ZqUPU9nEOjGy0gI07dciVcYZQ+CiZeSECIWgQwjDEBDuwMCVAZA6gfdz6C KJuN+RUSKPEcxPxle1MiB4MU0ei5X4xUbvLWKn9Ok7TOXg2BpnMAv6eON1wVo0Aa +D265cqy6Le/toVg= + + + + + + + + + + + + + + + ICOS Carbon Portal SAML service + ICOS Kolportalens SAML tjänst + + + + + + + ICOS Carbon Portal + ICOS Kolportalen + Carbon Portal + Kolportalen + https://www.icos-cp.eu/ + https://www.icos-cp.eu/ + + + Oleg + Mirzov + mailto:oleg.mirzov@nateko.lu.se + + + Alex + Vermeulen + mailto:alex.vermeulen@nateko.lu.se + + + + + + http://swamid.se/policy/mdrps + + + + + + + + + + + + + + + + + + + + http://www.geant.net/uri/dataprotection-code-of-conduct/v1 + + + invalidValueForAttribute + + + + + + + + Carbon Portal authentication service + Kolportalens autentiseringstjänst + Single Sign On for services of ICOS Carbon Portal. Maintained by the Carbon Portal team at Physical Geography department (nateko.lu.se). + Single Sign On tjänst för ICOS Kolportalen. Hanteras av Carbon Portal teamet på INES (nateko.lu.se). + https://cpauth.icos-cp.eu/saml/privacyStatement + https://www.icos-cp.eu/ + https://www.icos-cp.eu/ + https://cpauth.icos-cp.eu/saml/privacyStatement + + + + + cpauth.icos-cp.eu + + CN=cpauth.icos-cp.eu + MIIEJzCCAw+gAwIBAgIJANC3VWNs7fbTMA0GCSqGSIb3DQEBCwUAMIGpMQswCQYD +VQQGEwJTRTERMA8GA1UECAwIU2vDg8KlbmUxDTALBgNVBAcMBEx1bmQxGzAZBgNV +BAoMEklDT1MgQ2FyYm9uIFBvcnRhbDEfMB0GA1UECwwWQXV0aGVudGljYXRpb24g +U2VydmljZTEaMBgGA1UEAwwRY3BhdXRoLmljb3MtY3AuZXUxHjAcBgkqhkiG9w0B +CQEWD2luZm9AaWNvcy1jcC5ldTAeFw0xNTAyMDUxMjI0MzZaFw0yNTAyMDIxMjI0 +MzZaMIGpMQswCQYDVQQGEwJTRTERMA8GA1UECAwIU2vDg8KlbmUxDTALBgNVBAcM +BEx1bmQxGzAZBgNVBAoMEklDT1MgQ2FyYm9uIFBvcnRhbDEfMB0GA1UECwwWQXV0 +aGVudGljYXRpb24gU2VydmljZTEaMBgGA1UEAwwRY3BhdXRoLmljb3MtY3AuZXUx +HjAcBgkqhkiG9w0BCQEWD2luZm9AaWNvcy1jcC5ldTCCASIwDQYJKoZIhvcNAQEB +BQADggEPADCCAQoCggEBAM2QN1jaZJeuPAH+4sVMZKk7vg4JIbUuTMKk0+KIAg5M +XiVsRiEUjY+LtIncrvA/kf2CIySI0WkbwZMjcDd03hNj4kLWhuyxfOCwDO6DsUbG +MbyI6HIYWXJp5ljfEEFgtMqT3dDtD5vwq8h4Zy20ukxOoIokKczrAvn4JjkMsj6Z +0CEAFBC29o4E8PWQbUBgvt6Z+2ao+RHMLD7nZVBx98Occ9KfnYnDDd9Oi1XFe009 +zaSbcqY2RpN8I9hcW/KQf3KnGW5xZ5dr4rhGklCkYr+h0W3xKu+hin8bk91t1Dkr +gaKl/N7M3Oof3k+7ZBlwaV97es5InWCeNgDxCGkBRNsCAwEAAaNQME4wHQYDVR0O +BBYEFDcD7MVudooGaNRYqXBYqQi3VzGxMB8GA1UdIwQYMBaAFDcD7MVudooGaNRY +qXBYqQi3VzGxMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBABS02eZS +weXGMJ2fEIy2JH0VhCbjuX/rz+8Hfh9LjzNb3QwKHuwP83yvPqRulV9FYmvOoK8T +fMou5aW0mZ+QgJNKOrxY5vFxUq6pn3OiYbBu3m1C9ajbU/nx2evzt4+qUwTfHFb+ +ZgXpOtmxRekFzVvGZ18BSPJKwAAqqZ11X7skT/NwEAhbgplVPv9WkDmDzqNvHqQJ +nyRgD2ZqUPU9nEOjGy0gI07dciVcYZQ+CiZeSECIWgQwjDEBDuwMCVAZA6gfdz6C +KJuN+RUSKPEcxPxle1MiB4MU0ei5X4xUbvLWKn9Ok7TOXg2BpnMAv6eON1wVo0Aa D265cqy6Le/toVg= From b39220353b3bd1b618b7fd500175665a525a65dc Mon Sep 17 00:00:00 2001 From: enriquepablo Date: Mon, 13 Jan 2025 11:51:36 +0100 Subject: [PATCH 2/2] warn when trust info has profiles with same name. Also allow extra metadata in trust info in entity attribute. --- src/pyff/samlmd.py | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/src/pyff/samlmd.py b/src/pyff/samlmd.py index c6f445b3..6593ee52 100644 --- a/src/pyff/samlmd.py +++ b/src/pyff/samlmd.py @@ -1048,18 +1048,27 @@ def discojson_sp_attr(e): return None entityID = e.get('entityID', None) - if entityID is None: - return None - sp = {} sp['entityID'] = entityID sp['profiles'] = {} + sp['extra_md'] = {} for b64_trustinfo in b64_trustinfos: try: str_trustinfo = b64decode(b64_trustinfo.encode('ascii')) trustinfo = json.loads(str_trustinfo.decode('utf8')) - sp['profiles'].update(trustinfo['profiles']) + for profile in trustinfo['profiles']: + if profile in sp['profiles']: + log.warning(f"SP Entity {entityID} has a duplicate trust profile {profile}") + else: + sp['profiles'][profile] = trustinfo['profiles'][profile] + + if 'extra_md' in trustinfo: + for extra_id in trustinfo['extra_md']: + if extra_id in sp['extra_md']: + log.warning(f"SP Entity {entityID} has a duplicate extra IdP metadata {extra_id}") + else: + sp['extra_md'][extra_id] = trustinfo['extra_md'][extra_id] except Exception as e: log.warning(f"Invalid entity-selection-profile attribute for {entityID}: {e}")