diff options
| author | Ivan Kanakarakis <ivan.kanak@gmail.com> | 2019-01-10 22:22:46 +0200 |
|---|---|---|
| committer | Ivan Kanakarakis <ivan.kanak@gmail.com> | 2019-01-14 13:31:46 +0200 |
| commit | 2cd3c84cdc9aeeccedbebe95494e1f831cdb36b1 (patch) | |
| tree | 9be348a32c5aad36dcb8a777409d77da3fb7ae29 /tests | |
| parent | dbbfe1e3b032a1ecf8e2c84eca5fa74728f257f2 (diff) | |
| download | pysaml2-2cd3c84cdc9aeeccedbebe95494e1f831cdb36b1.tar.gz | |
Raise XmlsecError if xmlsec1 returns an error
When xmlsec1 fails, it returns a non-zero returncode. The returncode was
checked only for values less than zero, and not greater than zero. This results
in situations where xmlsec1 fails to run a command, but the executation
continues as nothing failed. This happens to be ok, because, the result we
depend upon is coupled to xmlsec1's output stream. When xmlsec1 fails, the
output stream is empty and the error stream will have information relevant to
the failure cause.
Now, the check expects a returncode with value zero, otherwise an XmlsecError
exception is raised, to be handled by the caller up the stack.
This could have been a major security issue, but we stood lucky.
Special thanks to @pjsg for bringing this to our attention.
Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/test_40_sigver.py | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/tests/test_40_sigver.py b/tests/test_40_sigver.py index ba5cf639..e3a20e49 100644 --- a/tests/test_40_sigver.py +++ b/tests/test_40_sigver.py @@ -791,7 +791,7 @@ def test_xbox(): str(encrypted_assertion), conf.cert_file, pre, "des-192", '/*[local-name()="EncryptedAssertion"]/*[local-name()="Assertion"]') - decr_text = sec.decrypt(enctext) + decr_text = sec.decrypt(enctext, key_file=PRIV_KEY) _seass = saml.encrypted_assertion_from_string(decr_text) assertions = [] assers = extension_elements_to_elements(_seass.extension_elements, @@ -844,7 +844,7 @@ def test_xbox_non_ascii_ava(): str(encrypted_assertion), conf.cert_file, pre, "des-192", '/*[local-name()="EncryptedAssertion"]/*[local-name()="Assertion"]') - decr_text = sec.decrypt(enctext) + decr_text = sec.decrypt(enctext, key_file=PRIV_KEY) _seass = saml.encrypted_assertion_from_string(decr_text) assertions = [] assers = extension_elements_to_elements(_seass.extension_elements, |