This fixes XXE issues on anything where pysaml2 parses XML directly as part of

This fixes XXE issues on anything where pysaml2 parses XML directly as part of

issue #366. It doesn't address the xmlsec issues discussed on that ticket as

issue #366. It doesn't address the xmlsec issues discussed on that ticket as

they are out of reach of a direct fix and need the underlying library to fix

they are out of reach of a direct fix and need the underlying library to fix

this issue.

this issue.

.

.

The patch has been backported form the 3.0 branch to 2.0 by zigo@debian.org.

The patch has been backported form the 3.0 branch to 2.0 by zigo@debian.org.

    'pycrypto',  # 'Crypto'

    'pycrypto',  # 'Crypto'

    'pytz',

    'pytz',

    'pyOpenSSL',

    'pyOpenSSL',

]

]

tests_require = [

tests_require = [

        import cElementTree as ElementTree

        import cElementTree as ElementTree

    except ImportError:

    except ImportError:

        from elementtree import ElementTree

        from elementtree import ElementTree

root_logger = logging.getLogger(__name__)

root_logger = logging.getLogger(__name__)

root_logger.level = logging.NOTSET

root_logger.level = logging.NOTSET

        the contents of the XML - or None if the root XML tag and namespace did 

        the contents of the XML - or None if the root XML tag and namespace did 

        not match those of the target class.

        not match those of the target class.

    """

    """

    return create_class_from_element_tree(target_class, tree)

    return create_class_from_element_tree(target_class, tree)

def extension_element_from_string(xml_string):

def extension_element_from_string(xml_string):

    return _extension_element_from_element_tree(element_tree)

    return _extension_element_from_element_tree(element_tree)

        import cElementTree as ElementTree

        import cElementTree as ElementTree

    except ImportError:

    except ImportError:

        from elementtree import ElementTree

        from elementtree import ElementTree

NAMESPACE = "http://schemas.xmlsoap.org/soap/envelope/"

NAMESPACE = "http://schemas.xmlsoap.org/soap/envelope/"

FORM_SPEC = """<form method="post" action="%s">

FORM_SPEC = """<form method="post" action="%s">

    :param text: The SOAP object as XML 

    :param text: The SOAP object as XML 

    :return: header parts and body as saml.samlbase instances

    :return: header parts and body as saml.samlbase instances

    """

    """

    assert envelope.tag == '{%s}Envelope' % NAMESPACE

    assert envelope.tag == '{%s}Envelope' % NAMESPACE

    #print len(envelope)

    #print len(envelope)

    except ImportError:

    except ImportError:

        #noinspection PyUnresolvedReferences

        #noinspection PyUnresolvedReferences

        from elementtree import ElementTree

        from elementtree import ElementTree

logger = logging.getLogger(__name__)

logger = logging.getLogger(__name__)

    :param expected_tags: What the tag of the SAML thingy is expected to be.

    :param expected_tags: What the tag of the SAML thingy is expected to be.

    :return: SAML thingy as a string

    :return: SAML thingy as a string

    """

    """

    # Make sure it's a SOAP message

    # Make sure it's a SOAP message

    assert envelope.tag == '{%s}Envelope' % soapenv.NAMESPACE

    assert envelope.tag == '{%s}Envelope' % soapenv.NAMESPACE

    :return: The body and headers as class instances

    :return: The body and headers as class instances

    """

    """

    try:

    try:

    except Exception, exc:

    except Exception, exc:

        raise XmlParseError("%s" % exc)

        raise XmlParseError("%s" % exc)

    :return: dictionary with two keys "body"/"header"

    :return: dictionary with two keys "body"/"header"

    """

    """

    try:

    try:

    except Exception, exc:

    except Exception, exc:

        raise XmlParseError("%s" % exc)

        raise XmlParseError("%s" % exc)

        import cElementTree as ElementTree

        import cElementTree as ElementTree

    except ImportError:

    except ImportError:

        from elementtree import ElementTree

        from elementtree import ElementTree

ITEMS = {

ITEMS = {

    NameID: ["""<?xml version="1.0" encoding="utf-8"?>

    NameID: ["""<?xml version="1.0" encoding="utf-8"?>

    assert kl == None

    assert kl == None

def test_ee_1():

def test_ee_1():

    ee = saml2.extension_element_from_string(

    ee = saml2.extension_element_from_string(

        """<?xml version='1.0' encoding='UTF-8'?><foo>bar</foo>""")

        """<?xml version='1.0' encoding='UTF-8'?><foo>bar</foo>""")

    assert nid.text.strip() == "http://federationX.org"

    assert nid.text.strip() == "http://federationX.org"

def test_extension_element_loadd():

def test_extension_element_loadd():

    ava = {'attributes': {},

    ava = {'attributes': {},

           'tag': 'ExternalEntityAttributeAuthority',

           'tag': 'ExternalEntityAttributeAuthority',

        import cElementTree as ElementTree

        import cElementTree as ElementTree

    except ImportError:

    except ImportError:

        from elementtree import ElementTree

        from elementtree import ElementTree

import saml2.samlp as samlp

import saml2.samlp as samlp

from saml2.samlp import NAMESPACE as SAMLP_NAMESPACE

from saml2.samlp import NAMESPACE as SAMLP_NAMESPACE

NAMESPACE = "http://schemas.xmlsoap.org/soap/envelope/"

NAMESPACE = "http://schemas.xmlsoap.org/soap/envelope/"

    assert len(body) == 1

    assert len(body) == 1

    saml_part = body[0]

    saml_part = body[0]

    assert saml_part.tag == '{%s}AuthnRequest' % SAMLP_NAMESPACE

    assert saml_part.tag == '{%s}AuthnRequest' % SAMLP_NAMESPACE

import base64

import base64

import urllib

import urllib

import urlparse

import urlparse

from saml2.authn_context import INTERNETPROTOCOLPASSWORD

from saml2.authn_context import INTERNETPROTOCOLPASSWORD

from saml2.response import LogoutResponse

from saml2.response import LogoutResponse

from saml2 import samlp, BINDING_HTTP_POST, BINDING_HTTP_REDIRECT

from saml2 import samlp, BINDING_HTTP_POST, BINDING_HTTP_REDIRECT

from saml2 import saml, config, class_name

from saml2 import saml, config, class_name

from saml2.config import SPConfig

from saml2.config import SPConfig

from saml2.saml import NAMEID_FORMAT_PERSISTENT

from saml2.saml import NAMEID_FORMAT_PERSISTENT

from saml2.saml import NAMEID_FORMAT_TRANSIENT

from saml2.saml import NAMEID_FORMAT_TRANSIENT

from saml2.saml import NameID

from saml2.saml import NameID

from saml2.time_util import in_a_while

from saml2.time_util import in_a_while

from py.test import raises

from py.test import raises

from fakeIDP import FakeIDP, unpack_form

from fakeIDP import FakeIDP, unpack_form

               'http://www.example.com/login'

               'http://www.example.com/login'

        assert ac.authn_context_class_ref.text == INTERNETPROTOCOLPASSWORD

        assert ac.authn_context_class_ref.text == INTERNETPROTOCOLPASSWORD

# if __name__ == "__main__":

# if __name__ == "__main__":

#     tc = TestClient()

#     tc = TestClient()