hyperscale-stack / security / 39658414364

98%

push

github

fix(saml)!: close the 2026-10-21 security audit findings of the SAML SP

Close the SAML Service Provider findings of the security audit of
2026-10-21.

- Metadata import trusts one certificate per KeyDescriptor: a
  KeyDescriptor carrying several certificates (a chain) or a second
  KeyInfo is refused, and a signing KeyInfo whose ds:KeyValue or
  DEREncodedKeyValue is not the certificate's key is refused (SAML
  Metadata Interoperability Profile §2.5.1), so an issuing CA can no
  longer become a trusted signing key (F-13). Identifier hints
  (X509SKI, X509IssuerSerial, X509Digest, X509SubjectName, KeyName) are
  documented as neither verified nor used.
- A NameID made only of white space or invisible characters is refused
  (values are never trimmed); a sub-second TransactionTTL is refused at
  New (I-18, I-19).
- The memory storage purges expired records (WithClock) (D-19).
- examples/saml-sp refuses a login start without Fetch Metadata (D-18).
- Tests now kill the surviving assertion-Issuer, single-Status, sweep
  and use-filter mutants (F-24); docs scope the verified-bytes claim
  and the replay retention (I-20, I-21, I-22, D-17).

Breaking changes and migration steps: MIGRATION.md.

Audit: F-13, F-24, I-18, I-19, I-20, I-21, I-22, D-17, D-18, D-19.

130 of 130 new or added lines in 4 files covered. (100.0%)

14412 of 14626 relevant lines covered (98.54%)

5220.69 hits per line