Added Validations:

  - Validates only 1 assertion is present
  - Validates Timestamps

Author: LuisVM

lib/onelogin/saml/xmlsec.php

@@ -1,4 +1,5 @@
 <?php
+
   require(dirname(__FILE__) . '/../../xmlseclibs/xmlseclibs.php');
 
   class XmlSec {
@@ -9,6 +10,28 @@ function __construct($val) {
       $this->doc = $val;
     }
 
+    function validateNumAssertions(){
+      $rootNode = $this->doc; //->documentElement->ownerDocument;
+      $assertionNodes = $rootNode->getElementsByTagName('Assertion');
+      return ($assertionNodes->length == 1);
+    }
+
+    function validateTimestamps(){
+      $rootNode = $this->doc;
+      $timestampNodes = $rootNode->getElementsByTagName('Conditions');
+      for($i=0;$i<$timestampNodes->length;$i++){
+        $nbAttribute = $timestampNodes->item($i)->attributes->getNamedItem("NotBefore");
+        $naAttribute = $timestampNodes->item($i)->attributes->getNamedItem("NotOnOrAfter");
+        if($nbAttribute && strtotime($nbAttribute->textContent) > time()){
+            return false;
+        }
+        if($naAttribute && strtotime($naAttribute->textContent) <= time()){
+            return false;
+        }
+      }
+      return true;
+    }
+ 
     function is_valid() {
     	$objXMLSecDSig = new XMLSecurityDSig();
 
@@ -20,7 +43,6 @@ function is_valid() {
     	$objXMLSecDSig->idKeys = array('ID');
 
     	$retVal = $objXMLSecDSig->validateReference();
-
     	if (! $retVal) {
     		throw new Exception("Reference Validation Failed");
     	}
@@ -31,13 +53,24 @@ function is_valid() {
     	}
     	$key = NULL;
 
+    	$singleAssertion = $this->validateNumAssertions();
+      if (!$singleAssertion){
+        throw new Exception("Only ONE SamlAssertion allowed");
+      }
+
+      $validTimestamps = $this->validateTimestamps();
+      if (!$validTimestamps){
+        throw new Exception("Check your timestamp conditions");
+      }
+
     	$objKeyInfo = XMLSecEnc::staticLocateKeyInfo($objKey, $objDSig);
 
       $objKey->loadKey($this->x509certificate, FALSE, true);
-      
+        
     	$result = $objXMLSecDSig->verify($objKey);
     	return $result;
     }
-  }
 
-?>
+ }
+
+?>