merge

Author: Christian Pedersen

lib/onelogin/saml/xmlsec.php

@@ -1,4 +1,5 @@
 <?php
+
   require(dirname(__FILE__) . '/../../xmlseclibs/xmlseclibs.php');
 
   /**
@@ -29,13 +30,37 @@ function __construct($settings, $document) {
       $this->document = $document;
     }
 
+
     /**
      * Determine if the document passes the security test.
      *
      * @return
      *   TRUE if the document passes. This could throw a generic Exception
      *   if the document or key cannot be found.
      */
+    
+    function validateNumAssertions(){
+      $rootNode = $this->doc; //->documentElement->ownerDocument;
+      $assertionNodes = $rootNode->getElementsByTagName('Assertion');
+      return ($assertionNodes->length == 1);
+    }
+
+    function validateTimestamps(){
+      $rootNode = $this->doc;
+      $timestampNodes = $rootNode->getElementsByTagName('Conditions');
+      for($i=0;$i<$timestampNodes->length;$i++){
+        $nbAttribute = $timestampNodes->item($i)->attributes->getNamedItem("NotBefore");
+        $naAttribute = $timestampNodes->item($i)->attributes->getNamedItem("NotOnOrAfter");
+        if($nbAttribute && strtotime($nbAttribute->textContent) > time()){
+            return false;
+        }
+        if($naAttribute && strtotime($naAttribute->textContent) <= time()){
+            return false;
+        }
+      }
+      return true;
+    }
+ 
     function is_valid() {
     	$objXMLSecDSig = new XMLSecurityDSig();
 
@@ -47,7 +72,6 @@ function is_valid() {
     	$objXMLSecDSig->idKeys = array('ID');
 
     	$retVal = $objXMLSecDSig->validateReference();
-
     	if (! $retVal) {
     		throw new Exception("Reference Validation Failed");
     	}
@@ -58,13 +82,24 @@ function is_valid() {
     	}
     	$key = NULL;
 
+    	$singleAssertion = $this->validateNumAssertions();
+      if (!$singleAssertion){
+        throw new Exception("Only ONE SamlAssertion allowed");
+      }
+
+      $validTimestamps = $this->validateTimestamps();
+      if (!$validTimestamps){
+        throw new Exception("Check your timestamp conditions");
+      }
+
     	$objKeyInfo = XMLSecEnc::staticLocateKeyInfo($objKey, $objDSig);
 
       $objKey->loadKey($this->settings->x509certificate, FALSE, true);
 
     	$result = $objXMLSecDSig->verify($objKey);
     	return $result;
     }
-  }
 
-?>
+ }
+
+?>