From 6aec71b95fa7299478a903b181a7667f2e34d29a Mon Sep 17 00:00:00 2001
From: Olav Morken <olav.morken@uninett.no>
Date: Thu, 24 Jan 2008 11:53:29 +0000
Subject: [PATCH] Shib13:AuthnResponse: Escape data in xml output.
git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@189 44740490-163a-0410-bde0-09ae8108e29a
---
lib/SimpleSAML/XML/Shib13/AuthnResponse.php | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/lib/SimpleSAML/XML/Shib13/AuthnResponse.php b/lib/SimpleSAML/XML/Shib13/AuthnResponse.php
index c48d58c05..7ad10749c 100644
--- a/lib/SimpleSAML/XML/Shib13/AuthnResponse.php
+++ b/lib/SimpleSAML/XML/Shib13/AuthnResponse.php
@@ -398,8 +398,8 @@ class SimpleSAML_XML_Shib13_AuthnResponse extends SimpleSAML_XML_AuthnResponse {
$encodedattributes .= '<AttributeStatement>
<Subject>
- <NameIdentifier Format="urn:mace:shibboleth:1.0:nameIdentifier" NameQualifier="' . $spnamequalifier . '"
- >' . $nameid . '</NameIdentifier>
+ <NameIdentifier Format="urn:mace:shibboleth:1.0:nameIdentifier" NameQualifier="' . htmlspecialchars($spnamequalifier) . '"
+ >' . htmlspecialchars($nameid) . '</NameIdentifier>
</Subject>';
foreach ($attributes AS $name => $value) {
@@ -419,7 +419,7 @@ class SimpleSAML_XML_Shib13_AuthnResponse extends SimpleSAML_XML_AuthnResponse {
xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" IssueInstant="' . $issueInstant. '"
MajorVersion="1" MinorVersion="1"
- Recipient="' . $shire . '"
+ Recipient="' . htmlspecialchars($shire) . '"
ResponseID="' . $id . '">
<Status>
@@ -429,17 +429,17 @@ class SimpleSAML_XML_Shib13_AuthnResponse extends SimpleSAML_XML_AuthnResponse {
</Status>
<Assertion xmlns="urn:oasis:names:tc:SAML:1.0:assertion"
AssertionID="' . $assertionid . '" IssueInstant="' . $issueInstant. '"
- Issuer="' . $issuer . '" MajorVersion="1" MinorVersion="1">
+ Issuer="' . htmlspecialchars($issuer) . '" MajorVersion="1" MinorVersion="1">
<Conditions NotBefore="' . $issueInstant. '" NotOnOrAfter="'. $assertionExpire . '">
<AudienceRestrictionCondition>
- <Audience>' . $audience . '</Audience>
+ <Audience>' . htmlspecialchars($audience) . '</Audience>
</AudienceRestrictionCondition>
</Conditions>
<AuthenticationStatement AuthenticationInstant="' . $issueInstant. '"
AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:unspecified">
<Subject>
- <NameIdentifier Format="urn:mace:shibboleth:1.0:nameIdentifier" NameQualifier="' . $spnamequalifier . '"
- >' . $nameid . '</NameIdentifier>
+ <NameIdentifier Format="urn:mace:shibboleth:1.0:nameIdentifier" NameQualifier="' . htmlspecialchars($spnamequalifier) . '"
+ >' . htmlspecialchars($nameid) . '</NameIdentifier>
<SubjectConfirmation>
<ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</ConfirmationMethod>
</SubjectConfirmation>
@@ -458,7 +458,7 @@ class SimpleSAML_XML_Shib13_AuthnResponse extends SimpleSAML_XML_AuthnResponse {
private function enc_attribute($name, $value, $base64 = false) {
- return '<Attribute AttributeName="' . $name . '"
+ return '<Attribute AttributeName="' . htmlspecialchars($name) . '"
AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri">
<AttributeValue>' . ($base64 ? base64_encode($value) : htmlspecialchars($value) ) . '</AttributeValue>
</Attribute>';
--
GitLab