Merge pull request #1397 from pagopa/align-dev-20250121

Fix SAML signature verification (#1396)
pagopa · Jan 21, 2025 · 6714dd4 · 6714dd4
2 parents 73e35fc + e2a38df
commit 6714dd4
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/packages/backend-for-frontend/.env b/packages/backend-for-frontend/.env
@@ -19,7 +19,7 @@ SAML_AUDIENCE=selfcare.dev.interop.pagopa.it
 PAGOPA_TENANT_ID=69e2865e-65ab-4e48-a638-2037a9ee2ee7
 SAML_CALLBACK_URL="http://test.com/saml2/callback"
 SAML_CALLBACK_ERROR_URL="http://test.com/saml2/error"
-SAML_PUBLIC_KEY=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoQKapTgYkI9yZCHcNmJSY0giW4i5Qice5VK7SKbOXWsrdXIC5v9ckTSzqkiCzrHblGu4Ep7A/LULWdzUxDW5t6Jjn1rRxpWmTF/LX7to5HGIPH1kJ70gRROAyPUOqMtMUGVuLLKhgcMx71HDaT0OLSqsc0voQEcsBeppsZjFK0WqX9SzPvL3axIhhiBetckQ3R0AgwcZog4h+z3Dv8ngnAcrL3Nbsx6lGpHd7mtScw2JYe1R0C8092hWBZJqRsXUcCOo1piLoa0OwE+sxE+nJfSLjrQV6QkLgJljUUz6a4SwxWbuRyD6voY258GT1hIlvarydG6ctr+0sEfelDWB5QIDAQAB
+SAML_PUBLIC_KEY="-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoQKapTgYkI9yZCHcNmJS\nY0giW4i5Qice5VK7SKbOXWsrdXIC5v9ckTSzqkiCzrHblGu4Ep7A/LULWdzUxDW5\nt6Jjn1rRxpWmTF/LX7to5HGIPH1kJ70gRROAyPUOqMtMUGVuLLKhgcMx71HDaT0O\nLSqsc0voQEcsBeppsZjFK0WqX9SzPvL3axIhhiBetckQ3R0AgwcZog4h+z3Dv8ng\nnAcrL3Nbsx6lGpHd7mtScw2JYe1R0C8092hWBZJqRsXUcCOo1piLoa0OwE+sxE+n\nJfSLjrQV6QkLgJljUUz6a4SwxWbuRyD6voY258GT1hIlvarydG6ctr+0sEfelDWB\n5QIDAQAB\n-----END PUBLIC KEY-----"
 
 ALLOW_LIST_CONTAINER="interop-local-bucket"
 ALLOW_LIST_PATH="allow-list"

diff --git a/packages/backend-for-frontend/src/utilities/samlValidator.ts b/packages/backend-for-frontend/src/utilities/samlValidator.ts
@@ -106,7 +106,14 @@ export const validateSamlResponse = (samlResponse: string): SAMLResponse => {
   });
 
   sig.loadSignature(node);
-  sig.checkSignature(samlResponse);
+  try {
+    const isValid = sig.checkSignature(samlResponse);
+    if (!isValid) {
+      throw samlNotValid("Signature is not valid");
+    }
+  } catch (e) {
+    throw samlNotValid("Signature contains errors");
+  }
 
   if (!response.Assertion || response.Assertion.length === 0) {
     throw samlNotValid("Missing Assertions");