Class: Saml::Kit::SignatureReference

Inherits:
Object
  • Object
show all
Defined in:
lib/saml/kit/signature_reference.rb

Overview

This class is responsible for deciding whether an xml digital signature actually covers the element it is attached to.

A cryptographically intact signature only proves that some element in the document is unmodified. xmldsig resolves a Reference by searching the whole document for a matching ID, so without this check an attacker can copy a valid signature onto a forged element and hide the element it really covers somewhere the schema still permits, e.g. saml:Advice or ds:Object.

Constant Summary collapse

ID_ATTR =

The id_attr handed to Xmldsig::Signature, which expands it into "//*[@ID=$uri or @Id=$uri]". Both resolvers must agree on this or the element we check is not the element that was digested.

'ID=$uri or @Id'
XPATH = 
'./ds:SignedInfo/ds:Reference'

Instance Method Summary collapse

Constructor Details

#initialize(node) ⇒ SignatureReference

Returns a new instance of SignatureReference.



21
22
23
 
# File 'lib/saml/kit/signature_reference.rb', line 21

def initialize(node)
  @node = node
end

Instance Method Details

#bound? ⇒ Boolean

Returns true when some Reference resolves to the element the signature hangs off, and resolves to nothing else.

Every Reference lives inside ds:SignedInfo, which ds:SignatureValue covers, so an attacker replaying a signature cannot add a Reference or retarget an existing one. Finding our element among them is therefore enough. SAML 2.0 core 5.4.2 permits only one, but documents carrying more exist, and each extra Reference only widens what the signature already commits to.

Returns:

  • (Boolean) 


34
35
36
37
38
 
# File 'lib/saml/kit/signature_reference.rb', line 34

def bound?
  return @bound if defined?(@bound)

  @bound = binds_parent_element?
end