Skip to content

Commit a05c57e

Browse files
mikaelfrykholmmikaelfrykholm
committed
Fixes #304
Test and fix for for #304. We now try and catch all exceptions when parsing trustinfo profile.
1 parent 2fc6c10 commit a05c57e

File tree

3 files changed

+101
-4
lines changed

3 files changed

+101
-4
lines changed

‎src/pyff/samlmd.py‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1055,10 +1055,12 @@ def discojson_sp_attr(e):
10551055
sp['profiles'] = {}
10561056

10571057
for b64_trustinfo in b64_trustinfos:
1058-
str_trustinfo = b64decode(b64_trustinfo.encode('ascii'))
1059-
trustinfo = json.loads(str_trustinfo.decode('utf8'))
1060-
sp['profiles'].update(trustinfo['profiles'])
1061-
1058+
try:
1059+
str_trustinfo = b64decode(b64_trustinfo.encode('ascii'))
1060+
trustinfo = json.loads(str_trustinfo.decode('utf8'))
1061+
sp['profiles'].update(trustinfo['profiles'])
1062+
except Exception:
1063+
log.error(f"Error parsing TrustInfo profile for {sp['entityID']}")
10621064
return sp
10631065

10641066

‎src/pyff/test/data/metadata/test-sp-trustinfo-in-attr-broken-base64.xml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<md:EntitiesDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute" xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:xrd="http://docs.oasis-open.org/ns/xri/xrd-1.0" xmlns:pyff="http://pyff.io/NS" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ser="http://eidas.europa.eu/metadata/servicelist" xmlns:eidas="http://eidas.europa.eu/saml-extensions" xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport" xmlns:samla="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" xmlns:wayf="http://sdss.ac.uk/2006/06/WAYF" xmlns:req-attr="urn:oasis:names:tc:SAML:protcol:ext:req-attr" Name="test">
3+
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport" xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi" xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute" xmlns:samla="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" entityID="https://fail.org/shibboleth">
4+
<md:Extensions>
5+
<mdattr:EntityAttributes>
6+
<samla:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Name="https://refeds.org/entity-selection-profile">
7+
<samla:AttributeValue>eyJwcm9maWxlcyI6eyJlZHVnYWluIjp7ImVudGl0aWVzIjpbeyJpbmNsdWRlIjpmYWxzZSwibWF0Y2giOiJyZWdpc3RyYXRpb25BdXRob3JpdHkiLCJzZWxlY3QiOiJodHRwczovL29wZW5hdGhlbnMubmV0In1dLCJzdHJpY3QiOiB0cnVlfX1</samla:AttributeValue>
8+
</samla:Attribute>
9+
</mdattr:EntityAttributes>
10+
</md:Extensions>
11+
<md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
12+
<md:Extensions>
13+
<init:RequestInitiator Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="https://fail.org/Shibboleth.sso/Login"/>
14+
<idpdisc:DiscoveryResponse Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="https://fail.org/Shibboleth.sso/Login" index="1"/>
15+
<init:RequestInitiator Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="https://fail.org/Shibboleth.sso/DS/swamid-test"/>
16+
<idpdisc:DiscoveryResponse Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="https://fail.org/Shibboleth.sso/DS/swamid-test" index="2"/>
17+
<init:RequestInitiator Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="https://fail.org/Shibboleth.sso/DS/seamless-access"/>
18+
<idpdisc:DiscoveryResponse Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="https://fail.org/Shibboleth.sso/DS/seamless-access" index="3"/>
19+
<mdui:UIInfo>
20+
<mdui:Description xml:lang="en">Fail SP</mdui:Description>
21+
<mdui:DisplayName xml:lang="en">Fail SP</mdui:DisplayName>
22+
</mdui:UIInfo>
23+
</md:Extensions>
24+
<md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://fail.org/Shibboleth.sso/Artifact/SOAP" index="1"/>
25+
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://fail.org/Shibboleth.sso/SLO/SOAP"/>
26+
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://fail.org/Shibboleth.sso/SLO/Redirect"/>
27+
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://fail.org/Shibboleth.sso/SLO/POST"/>
28+
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://fail.org/Shibboleth.sso/SLO/Artifact"/>
29+
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://fail.org/Shibboleth.sso/SAML2/POST" index="1"/>
30+
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://fail.org/Shibboleth.sso/SAML2/POST-SimpleSign" index="2"/>
31+
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://fail.org/Shibboleth.sso/SAML2/Artifact" index="3"/>
32+
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://fail.org/Shibboleth.sso/SAML2/ECP" index="4"/>
33+
</md:SPSSODescriptor>
34+
</md:EntityDescriptor>
35+
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport" xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi" xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute" xmlns:samla="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" entityID="https://ok.org/shibboleth">
36+
<md:Extensions>
37+
<mdattr:EntityAttributes>
38+
<samla:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Name="https://refeds.org/entity-selection-profile">
39+
<samla:AttributeValue>eyJwcm9maWxlcyI6eyJlZHVnYWluIjp7ImVudGl0aWVzIjpbeyJpbmNsdWRlIjpmYWxzZSwibWF0Y2giOiJyZWdpc3RyYXRpb25BdXRob3JpdHkiLCJzZWxlY3QiOiJodHRwczovL29wZW5hdGhlbnMubmV0In1dLCJzdHJpY3QiOiB0cnVlfX19</samla:AttributeValue>
40+
</samla:Attribute>
41+
</mdattr:EntityAttributes>
42+
</md:Extensions>
43+
<md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
44+
<md:Extensions>
45+
<init:RequestInitiator Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="https://ok.org/Shibboleth.sso/Login"/>
46+
<idpdisc:DiscoveryResponse Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="https://ok.org/Shibboleth.sso/Login" index="1"/>
47+
<init:RequestInitiator Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="https://ok.org/Shibboleth.sso/DS/swamid-test"/>
48+
<idpdisc:DiscoveryResponse Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="https://ok.org/Shibboleth.sso/DS/swamid-test" index="2"/>
49+
<init:RequestInitiator Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="https://ok.org/Shibboleth.sso/DS/seamless-access"/>
50+
<idpdisc:DiscoveryResponse Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="https://ok.org/Shibboleth.sso/DS/seamless-access" index="3"/>
51+
<mdui:UIInfo>
52+
<mdui:Description xml:lang="en">OK SP</mdui:Description>
53+
<mdui:DisplayName xml:lang="en">OK SP</mdui:DisplayName>
54+
</mdui:UIInfo>
55+
</md:Extensions>
56+
<md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://ok.org/Shibboleth.sso/Artifact/SOAP" index="1"/>
57+
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://ok.org/Shibboleth.sso/SLO/SOAP"/>
58+
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://ok.org/Shibboleth.sso/SLO/Redirect"/>
59+
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://ok.org/Shibboleth.sso/SLO/POST"/>
60+
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://ok.org/Shibboleth.sso/SLO/Artifact"/>
61+
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://ok.org/Shibboleth.sso/SAML2/POST" index="1"/>
62+
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://ok.org/Shibboleth.sso/SAML2/POST-SimpleSign" index="2"/>
63+
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://ok.org/Shibboleth.sso/SAML2/Artifact" index="3"/>
64+
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://ok.org/Shibboleth.sso/SAML2/ECP" index="4"/>
65+
</md:SPSSODescriptor>
66+
</md:EntityDescriptor>
67+
</md:EntitiesDescriptor>

‎src/pyff/test/test_pipeline.py‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -811,3 +811,31 @@ def test_discojson_sp_trustinfo_in_attr(self):
811811
pass
812812
finally:
813813
shutil.rmtree(tmpdir)
814+
815+
def test_discojson_sp_trustinfo_in_attr_broken_base64(self):
816+
with patch.multiple("sys", exit=self.sys_exit):
817+
tmpdir = tempfile.mkdtemp()
818+
os.rmdir(tmpdir) # lets make sure 'store' can recreate it
819+
try:
820+
self.exec_pipeline(
821+
f"""
822+
- load:
823+
- file://{self.datadir}/metadata/test-sp-trustinfo-in-attr-broken-base64.xml
824+
- select
825+
- discojson_sp_attr
826+
- publish:
827+
output: {tmpdir}/disco_sp_attr.json
828+
raw: true
829+
update_store: false
830+
"""
831+
)
832+
fn = f"{tmpdir}/disco_sp_attr.json"
833+
assert os.path.exists(fn)
834+
with open(fn) as f:
835+
sp_json = json.load(f)
836+
837+
assert 'https://ok.org/shibboleth' in str(sp_json)
838+
except OSError:
839+
pass
840+
finally:
841+
shutil.rmtree(tmpdir)

0 commit comments

Comments
 (0)