Skip to content

unqualified attributes should have an empty namespace #70

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Sep 24, 2015

Conversation

ma314smith
Copy link
Contributor

I was getting an incorrect digest value when trying to validate WS-Fed metadata. It ended up being an issue with the ordering of unqualified attributes.

Expected Canonical Output:

<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" ID="_8d1dcc18-2f1e-4a93-850b-e3a3081b3ca1" entityID="https://sts.windows.net/8bd6e98d-e212-4022-b13f-a244fab4c253/">
  <RoleDescriptor xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" protocolSupportEnumeration="http://docs.oasis-open.org/wsfed/federation/200706" xsi:type="fed:SecurityTokenServiceType">
  </RoleDescriptor>
</EntityDescriptor>  

Incorrect Canonical Output (note the change in order for "protocolSupportEnumeration"):

<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" ID="_8d1dcc18-2f1e-4a93-850b-e3a3081b3ca1" entityID="https://sts.windows.net/8bd6e98d-e212-4022-b13f-a244fab4c253/">
  <RoleDescriptor xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance "xsi:type="fed:SecurityTokenServiceType" protocolSupportEnumeration="http://docs.oasis-open.org/wsfed/federation/200706">
  </RoleDescriptor>
</EntityDescriptor>  

This was happening because the default namespace was being added to unqualified attributes in exclusive-canonicalization.js:

if (!attr.namespaceURI && defaultNS) { attr.namespaceURI = defaultNS; }

According to the spec, unqualified attributes should have an empty namespace. See the example, here and the note about "attr2": http://www.w3.org/TR/xml-c14n#Example-SETags

This pull request removes the line that was adding the default namespace, and includes a unit test to cover this scenario.

Note that 2 of the unit tests are failing for me (same behavior on Windows and on http://www.tutorialspoint.com/codingground.htm). The failing tests are "test with a document" and "test validating SAML response". I've verified that they were also failing without my change, so it doesn't appear to be related. They both use the same test xml, and a quick look at the canonical output shows some random &#xD; values, so maybe there are some whitespace/line endings that aren't being handled properly.

@bjrmatos
Copy link
Contributor

bjrmatos commented Sep 5, 2015

seems fine to me.. all tests passed in OSX, i will test in windows to see if i get failing tests

@bjrmatos
Copy link
Contributor

bjrmatos commented Sep 5, 2015

i made some changes in order to normalize line endings across OS, could you fix your PR and re-run the tests?.. also let me know if you still see the 2 failing tests in windows, i will test on windows later in order to verify the test cases.

@ma314smith
Copy link
Contributor Author

I'm still seeing the same 2 tests failing.

@bjrmatos
Copy link
Contributor

bjrmatos commented Sep 6, 2015

all test passed for me in windows 7 and node 0.10.36 (in current xml-crypto master branch)

image

could you delete your copy of xml-crypto (and fork), download again from github and re-run the tests?

in the past i noticed that some tests fails because git convert line endings based on the configuration found in the local computer.. however with the commit that i have done yesterday this should be resolved (I just checked this on my windows PC)

@bjrmatos
Copy link
Contributor

bjrmatos commented Sep 6, 2015

also.. in my windows all test passed with your fork

@ma314smith
Copy link
Contributor Author

ok, deleting my local copy and pulling it down again resolved the issue. all tests are passing now. i think we're good.

@bjrmatos
Copy link
Contributor

bjrmatos commented Sep 6, 2015

ok, all fine for me.. @yaronn are you ok with this? according to the spec this is the correct behaviour

@yaronn
Copy link
Contributor

yaronn commented Sep 23, 2015

looks good to me!

bjrmatos added a commit that referenced this pull request Sep 24, 2015
unqualified attributes should have an empty namespace
@bjrmatos bjrmatos merged commit da0d09a into node-saml:master Sep 24, 2015
@bjrmatos
Copy link
Contributor

done! thnks @ma314smith

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants