[java-metadata-aggregator] branch main updated: MDA-273 - Fix CRDetectionStage's identification of culprit entity
Ian Young
ian at iay.org.uk
Thu Oct 20 15:13:47 UTC 2022
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch main
in repository java-metadata-aggregator.
View the commit online:
http://git.shibboleth.net/view/?p=java-metadata-aggregator.git;a=commit;h=fec20d5965f388426b89c3c49390bf3911e344bb
The following commit(s) were added to refs/heads/main by this push:
new fec20d5 MDA-273 - Fix CRDetectionStage's identification of culprit entity
fec20d5 is described below
commit fec20d5965f388426b89c3c49390bf3911e344bb
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Thu Oct 20 16:13:44 2022 +0100
MDA-273 - Fix CRDetectionStage's identification of culprit entity
https://shibboleth.atlassian.net/browse/MDA-273
---
.../dom/saml/AbstractSAMLTraversalStage.java | 14 +++---
.../metadata/dom/saml/CRDetectionStageTest.java | 35 ++++++++++++---
.../metadata/dom/saml/CRDetectionStage-ID.xml | 52 ++++++++++++++++++++++
.../dom/saml/CRDetectionStage-entityID.xml | 52 ++++++++++++++++++++++
.../metadata/dom/saml/CRDetectionStage-noID.xml | 52 ++++++++++++++++++++++
5 files changed, 192 insertions(+), 13 deletions(-)
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/AbstractSAMLTraversalStage.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/AbstractSAMLTraversalStage.java
index f8aaafc..498cff2 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/AbstractSAMLTraversalStage.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/saml/AbstractSAMLTraversalStage.java
@@ -18,10 +18,12 @@
package net.shibboleth.metadata.dom.saml;
import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import javax.annotation.concurrent.ThreadSafe;
import org.w3c.dom.Attr;
import org.w3c.dom.Element;
+import org.w3c.dom.Node;
import net.shibboleth.metadata.dom.AbstractDOMTraversalStage;
import net.shibboleth.metadata.dom.DOMTraversalContext;
@@ -54,10 +56,10 @@ public abstract class AbstractSAMLTraversalStage <C extends DOMTraversalContext>
* @param element {@link Element} to locate the ancestor Entity of.
* @return ancestor EntityDescriptor {@link Element}, or null.
*/
- private Element ancestorEntity(@Nonnull final Element element) {
- for (Element e = element; e != null; e = (Element) e.getParentNode()) {
- if (SAMLMetadataSupport.isEntityDescriptor(e)) {
- return e;
+ private @Nullable Element ancestorEntity(@Nonnull final Element element) {
+ for (Node e = element; e != null && e.getNodeType() == Node.ELEMENT_NODE; e = e.getParentNode()) {
+ if (SAMLMetadataSupport.isEntityDescriptor((Element)e)) {
+ return (Element)e;
}
}
return null;
@@ -71,8 +73,8 @@ public abstract class AbstractSAMLTraversalStage <C extends DOMTraversalContext>
*/
@Override
protected String errorPrefix(@Nonnull final Element element) {
- if (SAMLMetadataSupport.isEntitiesDescriptor(element)) {
- final Element entity = ancestorEntity(element);
+ final @Nullable Element entity = ancestorEntity(element);
+ if (entity != null) {
final Attr id = entity.getAttributeNode("ID");
if (id != null) {
return id.getTextContent() + ": ";
diff --git a/mda-framework/src/test/java/net/shibboleth/metadata/dom/saml/CRDetectionStageTest.java b/mda-framework/src/test/java/net/shibboleth/metadata/dom/saml/CRDetectionStageTest.java
index 43f0975..3dc6293 100644
--- a/mda-framework/src/test/java/net/shibboleth/metadata/dom/saml/CRDetectionStageTest.java
+++ b/mda-framework/src/test/java/net/shibboleth/metadata/dom/saml/CRDetectionStageTest.java
@@ -98,22 +98,28 @@ public class CRDetectionStageTest extends BaseDOMTest {
return execute(item);
}
- private void expectError(final String filename, final String errorContains) throws Exception {
+ private ErrorStatus expectError(final String filename, final String errorContains) throws Exception {
final List<ErrorStatus> errors = execute(filename);
Assert.assertEquals(errors.size(), 1, "errors size on " + filename);
final ErrorStatus error = errors.get(0);
Assert.assertTrue(error.getStatusMessage().contains(errorContains),
filename + " does not contain " + errorContains);
+ return error;
}
+ private void expectErrorNoPrefix(final String filename, final String errorContains) throws Exception {
+ var error = expectError(filename, errorContains);
+ Assert.assertFalse(error.getStatusMessage().contains(": "));
+ }
+
@Test
public void testErrors() throws Exception {
- expectError("element.xml", "element");
- expectError("attribute.xml", "attribute");
- expectError("assumptions.xml", "carriage return"); // contains both
- expectError("nested-element.xml", "element");
- expectError("nested-attribute.xml", "attribute");
- expectError("multiple.xml", "element");
+ expectErrorNoPrefix("element.xml", "element");
+ expectErrorNoPrefix("attribute.xml", "attribute");
+ expectErrorNoPrefix("assumptions.xml", "carriage return"); // contains both
+ expectErrorNoPrefix("nested-element.xml", "element");
+ expectErrorNoPrefix("nested-attribute.xml", "attribute");
+ expectErrorNoPrefix("multiple.xml", "element");
}
@Test
@@ -121,4 +127,19 @@ public class CRDetectionStageTest extends BaseDOMTest {
final List<ErrorStatus> errors = execute("ok.xml");
Assert.assertTrue(errors.isEmpty());
}
+
+ @Test
+ public void testEntityWithID() throws Exception {
+ expectError("ID.xml", "uk000006: ");
+ }
+
+ @Test
+ public void testEntityWithEntityID() throws Exception {
+ expectError("entityID.xml", "https://idp2.iay.org.uk/idp/shibboleth: ");
+ }
+
+ @Test
+ public void testEntityWithNoEntityIDorID() throws Exception {
+ expectErrorNoPrefix("noID.xml", "element");
+ }
}
diff --git a/mda-framework/src/test/resources/net/shibboleth/metadata/dom/saml/CRDetectionStage-ID.xml b/mda-framework/src/test/resources/net/shibboleth/metadata/dom/saml/CRDetectionStage-ID.xml
new file mode 100644
index 0000000..a568116
--- /dev/null
+++ b/mda-framework/src/test/resources/net/shibboleth/metadata/dom/saml/CRDetectionStage-ID.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+ xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+ xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
+ xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init"
+ xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+ xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi"
+ xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
+ xmlns:remd="http://refeds.org/metadata"
+ xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+ xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
+ xmlns:ukfedlabel="http://ukfederation.org.uk/2006/11/label"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:oasis:names:tc:SAML:2.0:metadata saml-schema-metadata-2.0.xsd
+ urn:oasis:names:tc:SAML:metadata:algsupport sstc-saml-metadata-algsupport-v1.0.xsd
+ urn:oasis:names:tc:SAML:metadata:attribute sstc-metadata-attr.xsd
+ urn:oasis:names:tc:SAML:metadata:rpi saml-metadata-rpi-v1.0.xsd
+ urn:oasis:names:tc:SAML:metadata:ui sstc-saml-metadata-ui-v1.0.xsd
+ urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol sstc-saml-idp-discovery.xsd
+ urn:oasis:names:tc:SAML:profiles:SSO:request-init sstc-request-initiation.xsd
+ urn:oasis:names:tc:SAML:2.0:assertion saml-schema-assertion-2.0.xsd
+ urn:mace:shibboleth:metadata:1.0 shibboleth-metadata-1.0.xsd
+ http://ukfederation.org.uk/2006/11/label uk-fed-label.xsd
+ http://refeds.org/metadata refeds-metadata.xsd
+ http://www.w3.org/2001/04/xmlenc# xenc-schema.xsd
+ http://www.w3.org/2009/xmlenc11# xenc-schema-11.xsd
+ http://www.w3.org/2000/09/xmldsig# xmldsig-core-schema.xsd"
+ ID="uk000006" entityID="https://idp2.iay.org.uk/idp/shibboleth">
+ <IDPSSODescriptor
+ protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:2.0:protocol">
+ <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"
+ Location="https://idp2.iay.org.uk:8443/idp/profile/SAML1/SOAP/ArtifactResolution" index="1"/>
+ <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
+ Location="https://idp2.iay.org.uk:8443/idp/profile/SAML2/SOAP/ArtifactResolution" index="2"/>
+ <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
+ <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+ <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"
+ Location="https://idp2.iay.org.uk/idp/profile/Shibboleth/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+ Location="https://idp2.iay.org.uk/idp/profile/SAML2/POST/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
+ Location="https://idp2.iay.org.uk/idp/profile/SAML2/POST-SimpleSign/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+ Location="https://idp2.iay.org.uk/idp/profile/SAML2/Redirect/SSO"/>
+ </IDPSSODescriptor>
+ <Organization>
+ <OrganizationName xml:lang="en">Ian A.
Young</OrganizationName>
+ <OrganizationDisplayName xml:lang="en">Ian A. Young</OrganizationDisplayName>
+ <OrganizationURL xml:lang="en">http://iay.org.uk/</OrganizationURL>
+ </Organization>
+</EntityDescriptor>
diff --git a/mda-framework/src/test/resources/net/shibboleth/metadata/dom/saml/CRDetectionStage-entityID.xml b/mda-framework/src/test/resources/net/shibboleth/metadata/dom/saml/CRDetectionStage-entityID.xml
new file mode 100644
index 0000000..8c5e02a
--- /dev/null
+++ b/mda-framework/src/test/resources/net/shibboleth/metadata/dom/saml/CRDetectionStage-entityID.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+ xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+ xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
+ xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init"
+ xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+ xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi"
+ xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
+ xmlns:remd="http://refeds.org/metadata"
+ xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+ xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
+ xmlns:ukfedlabel="http://ukfederation.org.uk/2006/11/label"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:oasis:names:tc:SAML:2.0:metadata saml-schema-metadata-2.0.xsd
+ urn:oasis:names:tc:SAML:metadata:algsupport sstc-saml-metadata-algsupport-v1.0.xsd
+ urn:oasis:names:tc:SAML:metadata:attribute sstc-metadata-attr.xsd
+ urn:oasis:names:tc:SAML:metadata:rpi saml-metadata-rpi-v1.0.xsd
+ urn:oasis:names:tc:SAML:metadata:ui sstc-saml-metadata-ui-v1.0.xsd
+ urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol sstc-saml-idp-discovery.xsd
+ urn:oasis:names:tc:SAML:profiles:SSO:request-init sstc-request-initiation.xsd
+ urn:oasis:names:tc:SAML:2.0:assertion saml-schema-assertion-2.0.xsd
+ urn:mace:shibboleth:metadata:1.0 shibboleth-metadata-1.0.xsd
+ http://ukfederation.org.uk/2006/11/label uk-fed-label.xsd
+ http://refeds.org/metadata refeds-metadata.xsd
+ http://www.w3.org/2001/04/xmlenc# xenc-schema.xsd
+ http://www.w3.org/2009/xmlenc11# xenc-schema-11.xsd
+ http://www.w3.org/2000/09/xmldsig# xmldsig-core-schema.xsd"
+ entityID="https://idp2.iay.org.uk/idp/shibboleth">
+ <IDPSSODescriptor
+ protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:2.0:protocol">
+ <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"
+ Location="https://idp2.iay.org.uk:8443/idp/profile/SAML1/SOAP/ArtifactResolution" index="1"/>
+ <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
+ Location="https://idp2.iay.org.uk:8443/idp/profile/SAML2/SOAP/ArtifactResolution" index="2"/>
+ <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
+ <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+ <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"
+ Location="https://idp2.iay.org.uk/idp/profile/Shibboleth/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+ Location="https://idp2.iay.org.uk/idp/profile/SAML2/POST/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
+ Location="https://idp2.iay.org.uk/idp/profile/SAML2/POST-SimpleSign/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+ Location="https://idp2.iay.org.uk/idp/profile/SAML2/Redirect/SSO"/>
+ </IDPSSODescriptor>
+ <Organization>
+ <OrganizationName xml:lang="en">Ian A.
Young</OrganizationName>
+ <OrganizationDisplayName xml:lang="en">Ian A. Young</OrganizationDisplayName>
+ <OrganizationURL xml:lang="en">http://iay.org.uk/</OrganizationURL>
+ </Organization>
+</EntityDescriptor>
diff --git a/mda-framework/src/test/resources/net/shibboleth/metadata/dom/saml/CRDetectionStage-noID.xml b/mda-framework/src/test/resources/net/shibboleth/metadata/dom/saml/CRDetectionStage-noID.xml
new file mode 100644
index 0000000..b3ab9e3
--- /dev/null
+++ b/mda-framework/src/test/resources/net/shibboleth/metadata/dom/saml/CRDetectionStage-noID.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+ xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+ xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+ xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
+ xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init"
+ xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+ xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi"
+ xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
+ xmlns:remd="http://refeds.org/metadata"
+ xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+ xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
+ xmlns:ukfedlabel="http://ukfederation.org.uk/2006/11/label"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="urn:oasis:names:tc:SAML:2.0:metadata saml-schema-metadata-2.0.xsd
+ urn:oasis:names:tc:SAML:metadata:algsupport sstc-saml-metadata-algsupport-v1.0.xsd
+ urn:oasis:names:tc:SAML:metadata:attribute sstc-metadata-attr.xsd
+ urn:oasis:names:tc:SAML:metadata:rpi saml-metadata-rpi-v1.0.xsd
+ urn:oasis:names:tc:SAML:metadata:ui sstc-saml-metadata-ui-v1.0.xsd
+ urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol sstc-saml-idp-discovery.xsd
+ urn:oasis:names:tc:SAML:profiles:SSO:request-init sstc-request-initiation.xsd
+ urn:oasis:names:tc:SAML:2.0:assertion saml-schema-assertion-2.0.xsd
+ urn:mace:shibboleth:metadata:1.0 shibboleth-metadata-1.0.xsd
+ http://ukfederation.org.uk/2006/11/label uk-fed-label.xsd
+ http://refeds.org/metadata refeds-metadata.xsd
+ http://www.w3.org/2001/04/xmlenc# xenc-schema.xsd
+ http://www.w3.org/2009/xmlenc11# xenc-schema-11.xsd
+ http://www.w3.org/2000/09/xmldsig# xmldsig-core-schema.xsd"
+ >
+ <IDPSSODescriptor
+ protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:2.0:protocol">
+ <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"
+ Location="https://idp2.iay.org.uk:8443/idp/profile/SAML1/SOAP/ArtifactResolution" index="1"/>
+ <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
+ Location="https://idp2.iay.org.uk:8443/idp/profile/SAML2/SOAP/ArtifactResolution" index="2"/>
+ <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
+ <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+ <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"
+ Location="https://idp2.iay.org.uk/idp/profile/Shibboleth/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+ Location="https://idp2.iay.org.uk/idp/profile/SAML2/POST/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
+ Location="https://idp2.iay.org.uk/idp/profile/SAML2/POST-SimpleSign/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+ Location="https://idp2.iay.org.uk/idp/profile/SAML2/Redirect/SSO"/>
+ </IDPSSODescriptor>
+ <Organization>
+ <OrganizationName xml:lang="en">Ian A.
Young</OrganizationName>
+ <OrganizationDisplayName xml:lang="en">Ian A. Young</OrganizationDisplayName>
+ <OrganizationURL xml:lang="en">http://iay.org.uk/</OrganizationURL>
+ </Organization>
+</EntityDescriptor>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list