AUTH-255: Sanitize document.signed_element_id via a prepared statement

[Lordnibbler]

Status

READY

Description

Fixes a security vulnerability where OneLogin::RubySaml::Response#xpath_first_from_signed_assertion was vulnerable to arbitrary code execution through use of a maliciously formed SAML response using a Ruby eval() statement.

Todos

• Cleanup the Gemfile
• Test that the vulnerability occurs
• Fix vulnerability by using a sanitized REXML variable

Deploy Notes

Release a new version of Ruby-SAML along with this PR.

Steps to Test or Reproduce

Outline the steps to test or reproduce the PR here.

git pull --prune
git checkout AUTH-255
bundle
rake
# all tests pass!

Impacted Areas in Application

List general components of the application that this PR will affect.

• OneLogin::RubySaml::Response

[cthornton]

👍

[prateekm21]

👍

[luisvm]

🐟

irb(main):004:0> response.send(:xpath_first_from_signed_assertion)
=> true
irb(main):005:0> puts $evalled
true
=> nil

vs

irb(main):007:0> response.send(:xpath_first_from_signed_assertion)
=> nil
irb(main):008:0> puts $evalled

=> nil

[reedloden]

I've filed #252 to figure out a better process for handling these types of issues. Would prefer all ruby-saml users aren't 0-day'd by researchers publicly posting vulnerability info directly on GitHub without there being a fixed version of the gem available for upgrading.