github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #9121] [MERGED] fix(sso): upgrade samlify to 2.12.0 with XPath injection and XXE fixes #25353

New Issue
Closed
opened 2026-04-15 22:51:01 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 22:51:01 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/9121
Author: @gustavovalverde
Created: 4/11/2026
Status: ✅ Merged
Merged: 4/11/2026
Merged by: @gustavovalverde

Base: next ← Head: fix/sso-upgrade-samlify-2.12

📝 Commits (1)

  • f667a29 fix(sso): upgrade samlify to 2.12.0, normalize PEM whitespace

📊 Changes

5 files changed (+507 additions, -301 deletions)

View changed files

➕ .changeset/sso-upgrade-samlify.md (+15 -0)
📝 packages/sso/package.json (+1 -1)
📝 packages/sso/src/routes/helpers.ts (+20 -6)
📝 packages/sso/src/saml.test.ts (+459 -279)
📝 pnpm-lock.yaml (+12 -15)

📄 Description

Summary

Upgrades samlify from 2.10.2 to 2.12.0 for two security fixes and reduced dependency surface.

Security fixes in samlify 2.12.0:

  • XPath injection protection: all XPath expressions now use escapeXPathValue() instead of string interpolation
  • XXE (XML External Entity) prevention: the XML parser defaults to strict mode that rejects entity references

Dependency reduction:
Removes node-forge, pako, uuid, and camelcase in favor of Node built-ins (crypto, zlib, crypto.randomUUID). Four fewer transitive dependencies in the supply chain.

PEM normalization:
Adds normalizePem() helper in createSP/createIdP that trims leading whitespace from PEM keys and certificates. samlify 2.12.0 uses native crypto.createPrivateKey which rejects whitespace-indented PEM blocks (common when keys are stored in indented configs, env vars, or JSON). This prevents DECODER routines::unsupported errors.

Requires Node 20+ (samlify 2.11+ uses X509Certificate and crypto.randomUUID).

Summary by cubic

Upgraded samlify to 2.12.0 to patch XPath injection and XXE issues and reduce transitive dependencies (drops node-forge, pako, uuid, and camelcase). Added PEM whitespace normalization for SP/IdP private/encryption keys and certificates to prevent native crypto.createPrivateKey parse errors when values are indented.

  • Migration
    • Requires Node 20+.
    • No code changes needed; normalization is handled internally.

Written for commit f667a29e8d. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/9121 **Author:** [@gustavovalverde](https://github.com/gustavovalverde) **Created:** 4/11/2026 **Status:** ✅ Merged **Merged:** 4/11/2026 **Merged by:** [@gustavovalverde](https://github.com/gustavovalverde) **Base:** `next` ← **Head:** `fix/sso-upgrade-samlify-2.12` --- ### 📝 Commits (1) - [`f667a29`](https://github.com/better-auth/better-auth/commit/f667a29e8d9b89bd1cfcf32bcad78fabc35cb03a) fix(sso): upgrade samlify to 2.12.0, normalize PEM whitespace ### 📊 Changes **5 files changed** (+507 additions, -301 deletions) <details> <summary>View changed files</summary> ➕ `.changeset/sso-upgrade-samlify.md` (+15 -0) 📝 `packages/sso/package.json` (+1 -1) 📝 `packages/sso/src/routes/helpers.ts` (+20 -6) 📝 `packages/sso/src/saml.test.ts` (+459 -279) 📝 `pnpm-lock.yaml` (+12 -15) </details> ### 📄 Description ## Summary Upgrades samlify from 2.10.2 to 2.12.0 for two security fixes and reduced dependency surface. **Security fixes in samlify 2.12.0:** - XPath injection protection: all XPath expressions now use `escapeXPathValue()` instead of string interpolation - XXE (XML External Entity) prevention: the XML parser defaults to strict mode that rejects entity references **Dependency reduction:** Removes `node-forge`, `pako`, `uuid`, and `camelcase` in favor of Node built-ins (`crypto`, `zlib`, `crypto.randomUUID`). Four fewer transitive dependencies in the supply chain. **PEM normalization:** Adds `normalizePem()` helper in `createSP`/`createIdP` that trims leading whitespace from PEM keys and certificates. samlify 2.12.0 uses native `crypto.createPrivateKey` which rejects whitespace-indented PEM blocks (common when keys are stored in indented configs, env vars, or JSON). This prevents `DECODER routines::unsupported` errors. **Requires Node 20+** (samlify 2.11+ uses `X509Certificate` and `crypto.randomUUID`). <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Upgraded `samlify` to 2.12.0 to patch XPath injection and XXE issues and reduce transitive dependencies (drops `node-forge`, `pako`, `uuid`, and `camelcase`). Added PEM whitespace normalization for SP/IdP private/encryption keys and certificates to prevent native `crypto.createPrivateKey` parse errors when values are indented. - **Migration** - Requires Node 20+. - No code changes needed; normalization is handled internally. <sup>Written for commit f667a29e8d9b89bd1cfcf32bcad78fabc35cb03a. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 22:51:01 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#25353
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?