Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OneLogin::RubySaml::Response is broken on rexml 3.3.9 #729

Open
msxavi opened this issue Nov 5, 2024 · 1 comment
Open

OneLogin::RubySaml::Response is broken on rexml 3.3.9 #729

msxavi opened this issue Nov 5, 2024 · 1 comment

Comments

@msxavi
Copy link

msxavi commented Nov 5, 2024

Hi there,
Given an invalid SAMLResponse, the Response object now raises REXML::ParseException on rexml 3.3.9.

  1) SamlController POST #consume without an original page when invalid response
     Failure/Error:
       @sso_response ||= OneLogin::RubySaml::Response.new(
         params[:SAMLResponse],
         settings: sso_config.saml_settings,
         allowed_clock_drift: 60,
         skip_subject_confirmation: true
       )

     REXML::ParseException:
       Malformed XML: Content at the start of the document (got 'invalid')
       Line: 1
       Position: 7
       Last 80 unconsumed characters:
     # /usr/local/bundle/gems/rexml-3.3.9/lib/rexml/parsers/baseparser.rb:517:in `pull_event'

Which means the response interface is now broken on 1.17.0

response.is_valid?

Related to ruby/rexml#211

TIA

@pitbulk
Copy link
Collaborator

pitbulk commented Dec 13, 2024

Hi @msxavi

We could catch the REXML::ParseException when building the Response (and others), and raise an ArgumentError similar than

raise ArgumentError.new("Response XML is invalid")

as we do here

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants