github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 22:32:01 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #6836] [MERGED] feat(saml): reject SAML responses containing multiple assertions #15159

New Issue
Closed
opened 2026-04-13 09:51:39 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 09:51:39 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6836
Author: @Paola3stefania
Created: 12/17/2025
Status: ✅ Merged
Merged: 1/6/2026
Merged by: @himself65

Base: canary ← Head: feat/saml-single-assertion-enforcement

📝 Commits (10+)

📊 Changes

10 files changed (+739 additions, -37 deletions)

View changed files

📝 .cspell/tech-terms.txt (+2 -0)
📝 packages/sso/package.json (+2 -1)
📝 packages/sso/src/routes/sso.ts (+24 -1)
📝 packages/sso/src/saml.test.ts (+348 -0)
📝 packages/sso/src/saml/algorithms.ts (+1 -32)
➕ packages/sso/src/saml/assertions.test.ts (+239 -0)
➕ packages/sso/src/saml/assertions.ts (+62 -0)
📝 packages/sso/src/saml/index.ts (+2 -0)
➕ packages/sso/src/saml/parser.ts (+56 -0)
📝 pnpm-lock.yaml (+3 -3)

📄 Description

Summary by cubic

Enforces single-assertion SAML responses and fails fast when a response has zero or multiple assertions to block XSW-style injection. Validation runs before parsing in both SAML callback paths and supports plain and encrypted assertions.

  • New Features

    • Added validateSingleAssertion and countAssertions with clear API errors (SAML_NO_ASSERTION, SAML_MULTIPLE_ASSERTIONS, SAML_INVALID_ENCODING, SAML_INVALID_XML).
    • Applied validation in callbackSSOSAML and acsEndpoint before parsing; ACS redirects with error=multiple_assertions or error=no_assertion and include error_description; exported helpers from saml/index.ts.

  • Refactors

    • Centralized XML parsing and helpers (xmlParser, findNode, countAllNodes) in saml/parser.ts; hardened parser with processEntities: false and reused in algorithms.ts.
    • Added tests covering single/multiple/none assertions, namespaces, encrypted assertions, XSW patterns, and ACS/callback integration paths.

Written for commit a5e20a39a1. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6836 **Author:** [@Paola3stefania](https://github.com/Paola3stefania) **Created:** 12/17/2025 **Status:** ✅ Merged **Merged:** 1/6/2026 **Merged by:** [@himself65](https://github.com/himself65) **Base:** `canary` ← **Head:** `feat/saml-single-assertion-enforcement` --- ### 📝 Commits (10+) - [`83f6e18`](https://github.com/better-auth/better-auth/commit/83f6e18bc6459fcbc9db11f40f40477d39de760b) feat: new parser shared and validate first - [`f80790b`](https://github.com/better-auth/better-auth/commit/f80790beb33bf8fbaab6828eda3db2820f2002bf) feat: validate assertion - [`2e59fb1`](https://github.com/better-auth/better-auth/commit/2e59fb18c7d1f76e1a553bccff103d5d2c51bfa4) Merge branch 'canary' into feat/saml-single-assertion-enforcement - [`6b538f7`](https://github.com/better-auth/better-auth/commit/6b538f7c12bb77e97cbbf0d83e1972313aeffb8e) feat: integration test - [`2626f2c`](https://github.com/better-auth/better-auth/commit/2626f2c5cb7b8ae5a9488c342d742892e0aaa708) Merge branch 'feat/saml-single-assertion-enforcement' of https://github.com/better-auth/better-auth into feat/saml-single-assertion-enforcement - [`80fd1c1`](https://github.com/better-auth/better-auth/commit/80fd1c138100e542515079b594e4794992998840) make lint happy - [`0e704b7`](https://github.com/better-auth/better-auth/commit/0e704b7299301e4c09cbd1e758464ad6331c010b) fix lint - [`943c12f`](https://github.com/better-auth/better-auth/commit/943c12fb9d0a13429573f30aa9ad4b6dcb20845d) feat: missing processEntities: false an erro handling - [`088fd39`](https://github.com/better-auth/better-auth/commit/088fd396f6eb7e0810792a8d2ea4d5fd6aa8d596) make lint happy - [`fd70ba1`](https://github.com/better-auth/better-auth/commit/fd70ba1b08941ec62e4b0dcba3ce9d2f55780445) Merge branch 'canary' into feat/saml-single-assertion-enforcement ### 📊 Changes **10 files changed** (+739 additions, -37 deletions) <details> <summary>View changed files</summary> 📝 `.cspell/tech-terms.txt` (+2 -0) 📝 `packages/sso/package.json` (+2 -1) 📝 `packages/sso/src/routes/sso.ts` (+24 -1) 📝 `packages/sso/src/saml.test.ts` (+348 -0) 📝 `packages/sso/src/saml/algorithms.ts` (+1 -32) ➕ `packages/sso/src/saml/assertions.test.ts` (+239 -0) ➕ `packages/sso/src/saml/assertions.ts` (+62 -0) 📝 `packages/sso/src/saml/index.ts` (+2 -0) ➕ `packages/sso/src/saml/parser.ts` (+56 -0) 📝 `pnpm-lock.yaml` (+3 -3) </details> ### 📄 Description <!-- This is an auto-generated description by cubic. --> ## Summary by cubic Enforces single-assertion SAML responses and fails fast when a response has zero or multiple assertions to block XSW-style injection. Validation runs before parsing in both SAML callback paths and supports plain and encrypted assertions. - **New Features** - Added validateSingleAssertion and countAssertions with clear API errors (SAML_NO_ASSERTION, SAML_MULTIPLE_ASSERTIONS, SAML_INVALID_ENCODING, SAML_INVALID_XML). - Applied validation in callbackSSOSAML and acsEndpoint before parsing; ACS redirects with error=multiple_assertions or error=no_assertion and include error_description; exported helpers from saml/index.ts. - **Refactors** - Centralized XML parsing and helpers (xmlParser, findNode, countAllNodes) in saml/parser.ts; hardened parser with processEntities: false and reused in algorithms.ts. - Added tests covering single/multiple/none assertions, namespaces, encrypted assertions, XSW patterns, and ACS/callback integration paths. <sup>Written for commit a5e20a39a1305107eb51707889d9bfd260c15d76. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 09:51:39 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#15159
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?