Ensure that trust_mark_issuers claim is not possible in subordinate statements

Author: cicnavi

src/Federation/EntityStatement.php

@@ -276,6 +276,10 @@ public function getTrustMarkOwners(): ?TrustMarkOwnersClaimBag
     }
 
 
+    /**
+     * @throws \SimpleSAML\OpenID\Exceptions\JwsException
+     * @throws \SimpleSAML\OpenID\Exceptions\EntityStatementException
+     */
     public function getTrustMarkIssuers(): ?TrustMarkIssuersClaimBag
     {
         // trust_mark_issuers
@@ -291,6 +295,10 @@ public function getTrustMarkIssuers(): ?TrustMarkIssuersClaimBag
             return null;
         }
 
+        if (!$this->isConfiguration()) {
+            throw new EntityStatementException('Trust Mark Issuers claim encountered in non-configuration statement.');
+        }
+
         return $this->claimFactory->forFederation()->buildTrustMarkIssuersClaimBagFrom($trustMarkIssuersClaimData);
     }
 

tests/src/Federation/EntityStatementTest.php

@@ -396,6 +396,23 @@ public function testTrustMarkIssuersIsBuildUsingFactoryOptional(): void
     }
 
 
+    public function testTrustMarkIssuersClaimIsAllowedInConfigurationStatementOnly(): void
+    {
+        $this->validPayload['trust_mark_issuers'] = [
+            'trustMarkType' => ['https://issuer1.org', 'https://issuer2.org'],
+        ];
+        $this->validPayload['iss'] = 'something-else';
+
+        $this->expectException(JwsException::class);
+        $this->expectExceptionMessage('non-configuration');
+
+        $this->signatureMock->method('getProtectedHeader')->willReturn($this->sampleHeader);
+        $this->jsonHelperMock->method('decode')->willReturn($this->validPayload);
+
+        $this->sut()->getTrustMarkIssuers();
+    }
+
+
     public function testThrowsOnInvalidTrustMarks(): void
     {
         $this->validPayload['trust_marks'] = 'invalid';