Skip to content

Commit 0799719

Browse files
committed
Replaces some etree.tostring calls, that were introduced recfently, by the sanitized call provided by defusedxml . Release 2.2.3
1 parent 9dc6cbd commit 0799719

File tree

6 files changed

+15
-10
lines changed

6 files changed

+15
-10
lines changed

README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ Python3: [python3-saml](https://github.com/onelogin/python3-saml).
1414

1515
#### Warning ####
1616

17+
Update python-saml to 2.2.3, this version replaces some etree.tostring calls, that were introduced recfently, by the sanitized call provided by defusedxml
18+
1719
Update python-saml to 2.2.0, this version includes a security patch that contains extra validations that will prevent signature wrapping attacks. [CVE-2016-1000252](https://github.com/distributedweaknessfiling/DWF-Database-Artifacts/blob/master/DWF/2016/1000252/CVE-2016-1000252.json)
1820

1921
python-saml < v2.2.0 is vulnerable and allows signature wrapping!

changelog.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
11
# python-saml changelog
2+
### 2.2.3 (Jun 15, 2017)
3+
* Replace some etree.tostring calls, that were introduced recfently, by the sanitized call provided by defusedxml
4+
* Update dm.xmlsec.binding requirement to 1.3.3 version
5+
26
### 2.2.2 (May 18, 2017)
37
* Be able to relax SSL Certificate verification when retrieving idp metadata
48
* [#195](https://github.com/onelogin/python-saml/pull/195) Be able to register future SP x509cert on the settings and publish it on SP metadata

setup.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
setup(
1111
name='python-saml',
12-
version='2.2.2',
12+
version='2.2.3',
1313
description='Onelogin Python Toolkit. Add SAML support to your Python software using this library',
1414
classifiers=[
1515
'Development Status :: 5 - Production/Stable',

src/onelogin/saml2/auth.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313

1414
from base64 import b64encode
1515
from urllib import quote_plus
16-
from lxml import etree
16+
from defusedxml.lxml import tostring
1717

1818
from onelogin.saml2.settings import OneLogin_Saml2_Settings
1919
from onelogin.saml2.response import OneLogin_Saml2_Response
@@ -486,7 +486,7 @@ def get_last_response_xml(self, pretty_print_if_possible=False):
486486
if isinstance(self.__last_response, basestring):
487487
response = self.__last_response
488488
else:
489-
response = etree.tostring(self.__last_response, pretty_print=pretty_print_if_possible)
489+
response = tostring(self.__last_response, pretty_print=pretty_print_if_possible)
490490
return response
491491

492492
def get_last_request_xml(self):

src/onelogin/saml2/response.py

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,7 @@
1111

1212
from base64 import b64decode
1313
from copy import deepcopy
14-
from lxml import etree
15-
from defusedxml.lxml import fromstring
14+
from defusedxml.lxml import tostring, fromstring
1615
from xml.dom.minidom import Document
1716

1817
from onelogin.saml2.constants import OneLogin_Saml2_Constants
@@ -107,7 +106,7 @@ def is_valid(self, request_data, request_id=None, raise_exceptions=False):
107106
if self.__settings.is_strict():
108107
no_valid_xml_msg = 'Invalid SAML Response. Not match the saml-schema-protocol-2.0.xsd'
109108
res = OneLogin_Saml2_Utils.validate_xml(
110-
etree.tostring(self.document),
109+
tostring(self.document),
111110
'saml-schema-protocol-2.0.xsd',
112111
self.__settings.is_debug_active()
113112
)
@@ -120,7 +119,7 @@ def is_valid(self, request_data, request_id=None, raise_exceptions=False):
120119
# If encrypted, check also the decrypted document
121120
if self.encrypted:
122121
res = OneLogin_Saml2_Utils.validate_xml(
123-
etree.tostring(self.decrypted_document),
122+
tostring(self.decrypted_document),
124123
'saml-schema-protocol-2.0.xsd',
125124
self.__settings.is_debug_active()
126125
)

src/onelogin/saml2/utils.py

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,7 @@ def validate_xml(xml, schema, debug=False):
153153

154154
return 'invalid_xml'
155155

156-
return parseString(etree.tostring(dom, encoding='unicode').encode('utf-8'))
156+
return parseString(tostring(dom, encoding='unicode').encode('utf-8'))
157157

158158
@staticmethod
159159
def format_cert(cert, heads=True):
@@ -680,7 +680,7 @@ def generate_name_id(value, sp_nq, sp_format, cert=None, debug=False, nq=None):
680680

681681
edata = enc_ctx.encryptXml(enc_data, elem[0])
682682

683-
newdoc = parseString(etree.tostring(edata, encoding='unicode').encode('utf-8'))
683+
newdoc = parseString(tostring(edata, encoding='unicode').encode('utf-8'))
684684

685685
if newdoc.hasChildNodes():
686686
child = newdoc.firstChild
@@ -897,7 +897,7 @@ def add_sign(xml, key, cert, debug=False, sign_algorithm=OneLogin_Saml2_Constant
897897
dsig_ctx.signKey = sign_key
898898
dsig_ctx.sign(signature)
899899

900-
newdoc = parseString(etree.tostring(elem, encoding='unicode').encode('utf-8'))
900+
newdoc = parseString(tostring(elem, encoding='unicode').encode('utf-8'))
901901

902902
signature_nodes = newdoc.getElementsByTagName("Signature")
903903

0 commit comments

Comments
 (0)