Bug in parsing SP metadata

[Nicolas CARPi]

Hello,

I wish to report a potential bug in Shibboleth, due to the parsing of an
empty Name attribute.


In our application, we expose this in the metadata:

<md:RequestedAttribute Name="urn:oid:0.9.2342.19200300.100.1.3"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
FriendlyName="mail" isRequired="true"/>

<md:RequestedAttribute Name="User.FirstName"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
FriendlyName="givenName" isRequired="false"/>

(and other similar lines).

It turns out that if the "Name" attribute is empty, and Shibboleth is
parsing the SP metadata, everything will explode. Some users had to
remove our application so that the rest of their services could be
reached again.

Here is the log:
ERROR 
[org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?]
- Error occurred while attempting to refresh metadata from 
  'https://redacted.fr/metadata.php


It should be easy to reproduce:

1. Make it so that the SP metadata contains a RequestedAttribute with an
empty Name (Name="")
2. Parse that metadata with Shibboleth

Expected: some error
Observed: fatal crash

I'm attaching a broken metadata.xml to this email. To facilitate
reproduction.

Now I understand that having an empty Name in the first place is
non-compliant, and I've fixed the bug on my side.
(https://github.com/elabftw/elabftw/commit/40cfb809960739fc18864b3a8fa850e227741927).

I just wanted to let you know because in this case, having a single SP
misbehave would bring down all the other apps, which I think should not
be the case. An error should be thrown and gracefully handled.

Note: seems similar to https://shibboleth.atlassian.net/browse/IDP-741.  
At least improving the error message would be great, such as: "Found 
empty Name attribute in RequestedAttributes".

Best,
~Nicolas
-------------- next part --------------
A non-text attachment was scrubbed...
Name: broken-metadata.xml
Type: text/xml
Size: 1880 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/dev/attachments/20240913/3c389208/attachment.xml>