hyperscale-stack / security / 38332284595

98%

Build Type

push

github

Committed by web-flow

Commit Message

fix(saml)!: close the security audit findings of the SAML Service Provider

Stored login transactions carry a MAC under server-held keys
(Config.TransactionKeys, required), verified in constant time over the
derived ID, the browser binding, the payload and the expiry before any
stored field is used: a store writer can no longer rebind a login or drop
its ForceAuthn and requested context (ErrTransactionIntegrity). The
consumption uses the presented binding digest.

A login allows one signature verification: the transaction is consumed
after the binding, transaction, status and InResponseTo checks and before
any signature work, sequentially or concurrently. KeyInfo-less signatures
try the last good certificate first.

Connection.ResponseOrigins (opt-in) refuses an ACS POST from another
origin than the IdP's (Origin, else Referer; never "null"), closing the
login CSRF a leaked in-flight IdP URL allowed. The ACS checks the received
path, host and query (no opt-out); a Success Response needs InResponseTo.

Parser and correlation hardening: xml: attributes, DTDs in the tree,
exact Success status, certificate-less KeyInfo treated as absent, replay
key per connection, pinned aggregates, 2^63 ns durations, format
characters in status messages. Stores: ASCII-only payload (no utf8mb4 or
strict sql_mode requirement), Redis identical second save refused,
storetest retention over time. Config and ServiceProvider print and log
without keys.

BREAKING: TransactionKeys required; TransactionRecord.Integrity (SQL
column, Redis field); a response refused after the binding check ends the
login. See MIGRATION.md.

Audit: SAML-01, SAML-02, SAML-03, SAML-I1, SAML-I2, SAML-I3, SAML-I4, SAML-I5, SAML-I6, SAML-I7, SAML-I8, SAML-I9, SAML-I10, SAML-I11, SAML-I12, STORE-02, STORE-I2, STORE-I3.

Coverage Stats

518 of 533 new or added lines in 22 files covered. (97.19%)

4 existing lines in 2 files now uncovered.

11748 of 12072 relevant lines covered (97.32%)

2710.6 hits per line