<commit_before># encoding: utf-8
require 'spec_helper'

class XMLSecurity::SignedDocument

  def validate_doc(base64_cert, soft = true)
    # validate references

    # check for inclusive namespaces
    inclusive_namespaces = extract_inclusive_namespaces

    document = Nokogiri.parse(self.to_s)

    # create a working copy so we don't modify the original
    @working_copy ||= REXML::Document.new(self.to_s).root

    # store and remove signature node
    @sig_element ||= begin
                       element = REXML::XPath.first(@working_copy, "//ds:Signature", {"ds"=>DSIG})
                       element.remove
                     end


    # verify signature
    signed_info_element     = REXML::XPath.first(@sig_element, "//ds:SignedInfo", {"ds"=>DSIG})
    noko_sig_element = document.at_xpath('//ds:Signature', 'ds' => DSIG)
    noko_signed_info_element = noko_sig_element.at_xpath('./ds:SignedInfo', 'ds' => DSIG)
    canon_algorithm = canon_algorithm REXML::XPath.first(@sig_element, '//ds:CanonicalizationMethod', 'ds' => DSIG)
    canon_string = noko_signed_info_element.canonicalize(canon_algorithm)
    noko_sig_element.remove

    # check digests
    REXML::XPath.each(@sig_element, "//ds:Reference", {"ds"=>DSIG}) do |ref|
      uri                           = ref.attributes.get_attribute("URI").value

      hashed_element                = document.at_xpath("//*[@ID='#{uri[1..-1]}']")
      canon_algorithm               = canon_algorithm REXML::XPath.first(ref, '//ds:CanonicalizationMethod', 'ds' => DSIG)
      canon_hashed_element          = hashed_element.canonicalize(canon_algorithm, inclusive_namespaces)

      digest_algorithm              = algorithm(REXML::XPath.first(ref, "//ds:DigestMethod"))

      hash                          = digest_algorithm.digest(canon_hashed_element)
      digest_value                  = Base64.decode64(REXML::XPath.first(ref, "//ds:DigestValue", {"ds"=>DSIG}).text)

      unless digests_match?(hash, digest_value)
        return soft ? false : (raise Onelogin::Saml::ValidationError.new("Digest mismatch"))
      end
    end

    base64_signature        = REXML::XPath.first(@sig_element, "//ds:SignatureValue", {"ds"=>DSIG}).text
    signature               = Base64.decode64(base64_signature)

    # get certificate object
    cert_text               = Base64.decode64(base64_cert)
    cert                    = OpenSSL::X509::Certificate.new(cert_text)

    # signature method
    signature_algorithm     = algorithm(REXML::XPath.first(signed_info_element, "//ds:SignatureMethod", {"ds"=>DSIG}))

    unless cert.public_key.verify(signature_algorithm.new, signature, canon_string)
      return soft ? false : (raise Onelogin::Saml::ValidationError.new("Key validation error"))
    end

    return true
  end
end

describe SamlIdp::Controller do
  include SamlIdp::Controller

  def params
    @params ||= {}
  end

  it "should find the SAML ACS URL" do
    requested_saml_acs_url = "https://example.com/saml/consume"
    params[:SAMLRequest] = make_saml_request(requested_saml_acs_url)
    validate_saml_request
    saml_acs_url.should == requested_saml_acs_url
  end

  context "SAML Responses" do
    before(:each) do
      params[:SAMLRequest] = make_saml_request
      validate_saml_request
    end

    it "should create a SAML Response" do
      saml_response = encode_SAMLResponse("<EMAIL>")<commit_msg>dont need this patching for figuring out issues any more<commit_after># encoding: utf-8
require 'spec_helper'

describe SamlIdp::Controller do
  include SamlIdp::Controller

  def params
    @params ||= {}
  end

  it "should find the SAML ACS URL" do
    requested_saml_acs_url = "https://example.com/saml/consume"
    params[:SAMLRequest] = make_saml_request(requested_saml_acs_url)
    validate_saml_request
    saml_acs_url.should == requested_saml_acs_url
  end

  context "SAML Responses" do
    before(:each) do
      params[:SAMLRequest] = make_saml_request
      validate_saml_request
    end

    it "should create a SAML Response" do
      saml_response = encode_SAMLResponse("<EMAIL>")
{'fraction_non_alphanumeric': 0.11024007839294464, 'fraction_numerical': 0.006614404703576678, 'mean_word_length': 3.2575599582898853, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 15, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '342398', 'n_tokens_mistral': 1334, 'n_tokens_neox': 1276, 'n_words': 245}