Skip to content

Commit

Permalink
Be strict when checking return values.
Browse files Browse the repository at this point in the history
  • Loading branch information
jaimeperez committed Mar 2, 2018
1 parent 60b8d2b commit 4f6af7f
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/SAML2/HTTPRedirect.php
Original file line number Diff line number Diff line change
Expand Up @@ -226,7 +226,7 @@ public static function validateSignature(array $data, XMLSecurityKey $key)
$key = Utils::castKey($key, $sigAlg);
}

if (!$key->verifySignature($query, $signature)) {
if ($key->verifySignature($query, $signature) !== 1) {
throw new \Exception('Unable to validate signature on query string.');
}
}
Expand Down

2 comments on commit 4f6af7f

@jrchamp
Copy link

@jrchamp jrchamp commented on 4f6af7f Mar 6, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please consider adding a comment here about the importance and meaning of the integer value 1. It appears to depend heavily on the return codes from openssl_verify() and is directly mentioned in two published security advisories: https://simplesamlphp.org/security/201802-01 and https://simplesamlphp.org/security/201803-01

@thijskh
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the right place for that is the function's documentation in the library. I've created a PR for that. robrichards/xmlseclibs#168

Please sign in to comment.