Add some fixes to xmlseclibs. Extra protection verifying the Signature algorithm used on SignedInfo element, not only rely on verify / verifySignature methods

Author: pitbulk

extlib/xmlseclibs/xmlseclibs.php

@@ -282,7 +282,7 @@ public function loadKey($key, $isFile=false, $isCert = false) {
             } else {
                 $this->key = openssl_get_privatekey($this->key, $this->passphrase);
             }
-        } else if ($this->cryptParams['cipher'] == MCRYPT_RIJNDAEL_128) {
+        } else if (isset($this->cryptParams['cipher']) && $this->cryptParams['cipher'] == MCRYPT_RIJNDAEL_128) {
             /* Check key length */
             switch ($this->type) {
                 case (XMLSecurityKey::AES256_CBC):
@@ -724,7 +724,7 @@ public function validateDigest($refNode, $data) {
         $digValue = $this->calculateDigest($digestAlgorithm, $data, false);
         $query = 'string(./secdsig:DigestValue)';
         $digestValue = $xpath->evaluate($query, $refNode);
-        return ($digValue == base64_decode($digestValue));
+        return ($digValue === base64_decode($digestValue));
     }
 
     public function processTransforms($refNode, $objData, $includeCommentNodes = true) {
@@ -846,8 +846,6 @@ public function processRefNode($refNode) {
                 } else {
                     $dataObject = $refNode->ownerDocument;
                 }
-            } else {
-                $dataObject = file_get_contents($arUrl);
             }
         } else {
             /* This reference identifies the root node with an empty URI. This should

lib/Saml2/Utils.php

@@ -1189,6 +1189,10 @@ public static function castKey(XMLSecurityKey $key, $algorithm, $type = 'public'
             return $key;
         }
 
+        if (!OneLogin_Saml2_Utils::isSupportedSigningAlgorithm($algorithm)) {
+            throw new \Exception('Unsupported signing algorithm.');
+        }
+
         $keyInfo = openssl_pkey_get_details($key->key);
         if ($keyInfo === false) {
             throw new Exception('Unable to get key details from XMLSecurityKey.');
@@ -1201,6 +1205,17 @@ public static function castKey(XMLSecurityKey $key, $algorithm, $type = 'public'
         return $newKey;
     }
 
+    public static function isSupportedSigningAlgorithm($algorithm)
+    {
+        return in_array($algorithm, array(
+            XMLSecurityKey::RSA_1_5,
+            XMLSecurityKey::RSA_SHA1,
+            XMLSecurityKey::RSA_SHA256,
+            XMLSecurityKey::RSA_SHA384,
+            XMLSecurityKey::RSA_SHA512
+        ));
+    }
+
     /**
      * Adds signature key and senders certificate to an element (Message or Assertion).
      *
@@ -1312,6 +1327,10 @@ public static function validateSign($xml, $cert = null, $fingerprint = null, $fi
             throw new Exception('We have no idea about the key');
         }
 
+        if (!OneLogin_Saml2_Utils::isSupportedSigningAlgorithm($objKey->type)) {
+            throw new \Exception('Unsupported signing algorithm.');
+        }
+
         $objXMLSecDSig->canonicalizeSignedInfo();
 
         try {