ansdelft / ruby-saml

96%

push

github

Merge upstream (#4)

* Check message bytesize before Base64 validation

* Adapt tests to be able to execute signature validation sooner

* CI/CD: Update ubuntu version

* Add Ruby 3.4 to the CI

* Exclude Ubuntu-22.04 Ruby 2.2 from CI as it raises RubyGem/Bundler issues

* Release 1.18.1

* Update Changelog

* Fix several typos on the documentation and code. Add to the README how to force SP-Initiate flow and Prevent Reply Attacks

* Improve the inflate method to prevent potential DoS vulnerability in Zlib::Inflate (#779)

Improve the inflate method. Prevent potential DoS vulnerability in Zlib::Inflate by limiting the maximum decompressed size. The data is now inflated in chunks.

* Add sponsors: Github, SerpApi

* Add warning about CVE-2025-66567 and CVE-2025-66568

CVE-2025-66567 and CVE-2025-66568 affects ruby-saml <= 1.12.4. Use ruby-saml 1.18.1 instead.

* Revise vulnerability notice for ruby-saml

Updated vulnerability notice to reflect affected versions.

* Fix wrong link

---------

Co-authored-by: Drew Blessing <drew@blessing.io>
Co-authored-by: Sixto Martin <sixto.martin.garcia@workato.com>
Co-authored-by: Sixto Martin <sixto.martin.garcia@gmail.com>
Co-authored-by: Sixto Martin <pitbulk@gmail.com>

20 of 25 new or added lines in 1 file covered. (80.0%)

2043 of 2136 relevant lines covered (95.65%)

2276.68 hits per line