8000 Fix parsing SAML11 incorrect requests. (#609) by pskopek · Pull Request #49119 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Fix parsing SAML11 incorrect requests. (#609) #49119

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stianst merged 1 commit into from
May 19, 2026
Merged

Fix parsing SAML11 incorrect requests. (#609) #49119

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/saml/SAMLParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,8 +58,8 @@ public class SAMLParser extends AbstractParser {

private static final QName SAML_11_ASSERTION = new QName(SAML11Constants.ASSERTION_11_NSURI, JBossSAMLConstants.ASSERTION.get());
private static final QName SAML_11_ENCRYPTED_ASSERTION = new QName(SAML11Constants.ASSERTION_11_NSURI, JBossSAMLConstants.ENCRYPTED_ASSERTION.get());
private static final QName SAML_11_RESPONSE = new QName(SAML11Constants.ASSERTION_11_NSURI, JBossSAMLConstants.RESPONSE__PROTOCOL.get());
private static final QName SAML_11_REQUEST = new QName(SAML11Constants.ASSERTION_11_NSURI, JBossSAMLConstants.REQUEST.get());
private static final QName SAML_11_RESPONSE = new QName(SAML11Constants.PROTOCOL_11_NSURI, JBossSAMLConstants.RESPONSE__PROTOCOL.get());
private static final QName SAML_11_REQUEST = new QName(SAML11Constants.PROTOCOL_11_NSURI, JBossSAMLConstants.REQUEST.get());

// Since we have to support JDK 7, no lambdas are available
private interface ParserFactory {
Expand Down
8 changes: 8 additions & 0 deletions saml-core/src/main/java/org/keycloak/saml/processing/core/parsers/util/SAML11ParserUtil.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,6 +215,8 @@ public static SAML11SubjectConfirmationType parseSAML11SubjectConfirmation(XMLEv
subjectConfirmationType.setKeyInfo(keyInfo);
} else
throw logger.parserUnknownTag(startTag, startElement.getLocation());
} else {
throw logger.parserError(logger.parserFailed("Unexpected XML Event Type:" + Integer.valueOf(xmlEvent.getEventType())));
}
}
return subjectConfirmationType;
Expand Down Expand Up @@ -710,6 +712,8 @@ public static SAML11AttributeQueryType parseSAML11AttributeQuery(XMLEventReader
query.setSubject((SAML11SubjectType) parser.parse(xmlEventReader));
} else
throw logger.parserUnknownTag(startTag, startElement.getLocation());
} else {
throw logger.parserError(logger.parserFailed("Unexpected XML Event Type:" + Integer.valueOf(xmlEvent.getEventType())));
}
}
return query;
Expand Down Expand Up @@ -749,6 +753,8 @@ public static SAML11AuthenticationQueryType parseSAML11AuthenticationQuery(XMLEv
query.setSubject((SAML11SubjectType) parser.parse(xmlEventReader));
} else
throw logger.parserUnknownTag(startTag, startElement.getLocation());
} else {
throw logger.parserError(logger.parserFailed("Unexpected XML Event Type:" + Integer.valueOf(xmlEvent.getEventType())));
}
}
return query;
Expand Down Expand Up @@ -801,6 +807,8 @@ public static SAML11AuthorizationDecisionQueryType parseSAML11AuthorizationDecis
query.add(action);
} else
throw logger.parserUnknownTag(startTag, startElement.getLocation());
} else {
throw logger.parserError(logger.parserFailed("Unexpected XML Event Type:" + Integer.valueOf(xmlEvent.getEventType())));
}
}
return query;
Expand Down
8 changes: 8 additions & 0 deletions ...est/java/org/keycloak/saml/processing/core/parsers/saml/SAMLAttributeQueryParserTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@

import org.keycloak.dom.saml.v2.assertion.NameIDType;
import org.keycloak.dom.saml.v2.protocol.AttributeQueryType;
import org.keycloak.saml.common.exceptions.ParsingException;

import org.junit.Before;
import org.junit.Test;
Expand All @@ -47,6 +48,13 @@ public void initParser() {
this.parser = new SAMLParser();
}

@Test(expected = ParsingException.class)
public void testSaml11AttributeQueryWrong() throws Exception {
try (InputStream is = SAMLAttributeQueryParserTest.class.getResourceAsStream("saml11-attributequery-not-wellformed.xml")) {
parser.parse(is);
}
}

@Test(timeout = 2000000)
public void testSaml20AttributeQuery() throws Exception {
try (InputStream is = SAMLAttributeQueryParserTest.class.getResourceAsStream("saml20-attributequery.xml")) {
Expand Down
21 changes: 21 additions & 0 deletions saml-core/src/test/java/org/keycloak/saml/processing/core/parsers/saml/SAMLParserTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -763,6 +763,27 @@ public void testInvalidEndElement() throws Exception {
assertParsed("saml20-entity-descriptor-idp-invalid-end-element.xml", EntityDescriptorType.class);
}

@Test(expected = ParsingException.class)
public void testSaml11AssertionsNotWellFormed() throws Exception {
try (InputStream st = SAMLParserTest.class.getResourceAsStream("saml11-assertion-not-wellformed.xml")) {
parser.parse(st);
}
}

@Test(expected = ParsingException.class)
public void testSaml11AthorizationDecisionQueryNotWellFormed() throws Exception {
try (InputStream st = SAMLParserTest.class.getResourceAsStream("saml11-authorizatiodecisionquery-not-wellformed.xml")) {
parser.parse(st);
}
}

@Test(expected = ParsingException.class)
public void testSaml11AuthenticationQueryNotWellFormed() throws Exception {
try (InputStream st = SAMLParserTest.class.getResourceAsStream("saml11-authenticationquery-not-wellformed.xml")) {
parser.parse(st);
}
}

@Test
public void testMissingRequiredAttributeIDPSSODescriptorType() throws Exception {
testMissingAttribute("IDPSSODescriptorType", "protocolSupportEnumeration");
Expand Down
25 changes: 25 additions & 0 deletions ...ources/org/keycloak/saml/processing/core/parsers/saml/saml11-assertion-not-wellformed.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
<saml:Assertion
xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
MajorVersion="1" MinorVersion="1"
AssertionID="buGxcG4gILg5NlocyLccDz6iXrUa"
Issuer="https://idp.example.org/saml"
IssueInstant="2002-06-19T17:05:37.795Z">
<saml:Conditions
NotBefore="2002-06-19T17:00:37.795Z"
NotOnOrAfter="2002-06-19T17:10:37.795Z"/>
<saml:AuthenticationStatement
AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:password"
AuthenticationInstant="2002-06-19T17:05:17.706Z">
<saml:Subject>
<saml:NameIdentifier
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
user@idp.example.org
</saml:NameIdentifier>
<saml:SubjectConfirmation> problematic text
<saml:ConfirmationMethod>
urn:oasis:names:tc:SAML:1.0:cm:bearer
</saml:ConfirmationMethod>
</saml:SubjectConfirmation>
</saml:Subject>
</saml:AuthenticationStatement>
</saml:Assertion>
12 changes: 12 additions & 0 deletions ...s/org/keycloak/saml/processing/core/parsers/saml/saml11-attributequery-not-wellformed.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
<samlp:Reques 10000 t xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol"
xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
MajorVersion="1" MinorVersion="1"
RequestID="_1234567890" IssueInstant="2026-04-29T10:00:00Z">
<samlp:AttributeQuery> problematic text
<saml:Subject>
<saml:NameIdentifier Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
user@example.com
</saml:NameIdentifier>
</saml:Subject>
</samlp:AttributeQuery>
</samlp:Request>
17 changes: 17 additions & 0 deletions .../keycloak/saml/processing/core/parsers/saml/saml11-authenticationquery-not-wellformed.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
<samlp:Request
xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol"
xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
MajorVersion="1"
MinorVersion="1"
RequestID="_1234567890abcdef"
IssueInstant="2026-04-30T10:00:00Z">

<samlp:AuthenticationQuery>
<saml:Subject>
<saml:NameIdentifier
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
user@example.com
</saml:NameIdentifier>
</saml:Subject> problematic text
</samlp:AuthenticationQuery>
</samlp:Request>
24 changes: 24 additions & 0 deletions ...oak/saml/processing/core/parsers/saml/saml11-authorizatiodecisionquery-not-wellformed.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
<samlp:Request
xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol"
xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
MajorVersion="1" MinorVersion="1"
RequestID="authz-query-123"
IssueInstant="2026-04-30T10:00:00Z">

<samlp:AuthorizationDecisionQuery>
<!-- Subject being queried -->
<saml:Subject>
<saml:NameIdentifier Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
user@example.com
</saml:NameIdentifier>
</saml:Subject> problematic text

<saml:Resource>https://example.com</saml:Resource>

<!-- Action allowed -->
<saml:Action Namespace="urn:oasis:names:tc:SAML:1.0:action:rwedc-admin">
Read
</saml:Action>

</samlp:AuthorizationDecisionQuery>
</samlp:Request>
Loading
0