Merge branch 'release/4.3'

Author: MKodde

CHANGELOG.md

@@ -1,3 +1,7 @@
+# 4.3.2
+**Bugfix**
+* Secure the way the verifySignature method is used #104
+
 # 4.3.1
 **Bugfix**
 * Update metadata.xml template reference

src/Entity/HostedEntities.php

@@ -142,7 +142,7 @@ private function generateUrl($routeDefinition)
 
         $context = $this->router->getContext();
 
-        $context->fromRequest($this->requestStack->getMasterRequest());
+        $context->fromRequest($this->requestStack->getMainRequest());
 
         $url = $this->router->generate($route, $parameters, RouterInterface::ABSOLUTE_URL);
 

src/Http/ReceivedAuthnRequestQueryString.php

@@ -288,9 +288,10 @@ public function getSignedRequestPayload()
      */
     public function verify(XMLSecurityKey $key)
     {
-        if ($key->verifySignature($this->getSignedRequestPayload(), $this->getDecodedSignature())) {
-            return true;
+        $isVerified = $key->verifySignature($this->getSignedRequestPayload(), $this->getDecodedSignature());
+        if ($isVerified !== 1) {
+            return false;
         }
-        return false;
+        return true;
     }
 }

src/Signing/SignatureVerifier.php

@@ -21,7 +21,7 @@
 use Psr\Log\LoggerInterface;
 use RobRichards\XMLSecLibs\XMLSecurityKey;
 use SAML2\Certificate\Key;
-use SAML2\Certificate\KeyLoader as KeyLoader;
+use SAML2\Certificate\KeyLoader;
 use SAML2\Certificate\X509;
 use Surfnet\SamlBundle\Entity\ServiceProvider;
 use Surfnet\SamlBundle\Http\ReceivedAuthnRequestQueryString;
@@ -151,13 +151,13 @@ public function isSignedWith(AuthnRequest $request, X509 $publicKey)
         $key = new XMLSecurityKey(XMLSecurityKey::RSA_SHA256, array('type' => 'public'));
         $key->loadKey($publicKey->getCertificate());
 
-        if ($key->verifySignature($request->getSignedRequestQuery(), $request->getSignature())) {
-            $this->logger->debug('Signature VERIFIED');
-            return true;
+        $isVerified = $key->verifySignature($request->getSignedRequestQuery(), $request->getSignature());
+        if ($isVerified !== 1) {
+            $this->logger->debug('Signature NOT VERIFIED');
+            return false;
         }
 
-        $this->logger->debug('Signature NOT VERIFIED');
-
-        return false;
+        $this->logger->debug('Signature VERIFIED');
+        return true;
     }
 }