Bump python-saml from 2.1.3 to 2.4.0 in /social/tests

Open dependabot[bot] opened this issue 6 years ago • 0 comments

Bumps python-saml from 2.1.3 to 2.4.0.

Release notes

OneLogin's SAML Python Toolkit v2.4.0

Changelog:

Fix vulnerability CVE-2017-11427. Process text of nodes properly, ignoring comments

Improve how fingerprint is calcultated

Fix issue with LogoutRequest rejected by ADFS due NameID with unspecified format instead no format attribute

Be able to invalidate a SAMLResponse if it contains InResponseTo value but no RequestId parameter provided at the is_valid method. See rejectUnsolicitedResponsesWithInResponseTo security parameter (By default deactivated)

Fix signature position in the SP metadata

Redefine NSMAP constant

OneLogin's SAML Python Toolkit v2.3.0

#205 Improve decrypt method, Add an option to decrypt an element in place or copy it before decryption.

#204 On a LogoutRequest if the NameIdFormat is entity, NameQualifier and SPNameQualifier will be ommited. If the NameIdFormat is not entity and a NameQualifier is provided, then the SPNameQualifier will be also added.

Be able to get at the auth object the last processed ID (response/assertion) and the last generated ID.

Reset errorReason attribute of the auth object before each Process method

Fix issue on getting multiple certs when only sign or encryption certs

Allow empty nameid if setting wantNameId is false. Only raise Exceptions when strict mode is enabled

OneLogin's SAML Python Toolkit v2.2.3

Replace some etree.tostring calls, that were introduced recfently, by the sanitized call provided by defusedxml

Update dm.xmlsec.binding requirement to 1.3.3 version

OneLogin's SAML Python Toolkit v2.2.2

Changelog:

Be able to relax SSL Certificate verification when retrieving idp metadata

#195 Be able to register future SP x509cert on the settings and publish it on SP metadata

#195 Be able to register more than 1 Identity Provider x509cert, linked with an specific use (signing or encryption

#195 Allow metadata to be retrieved from source containing data of multiple entities

#195 Adapt IdP XML metadata parser to take care of multiple IdP certtificates and be able to inject the data obtained on the settings.

#194 Publish KeyDescriptor[use=encryption] only when required

#190 Checking the status of response before assertion count

Add Pyramid demo example

Allows underscores in URL hosts

NameID Format improvements

#184 Be able to provide a NameIDFormat to LogoutRequest

#180 Add DigestMethod support. (Add sign_algorithm and digest_algorithm parameters to sign_metadata and add_sign)

Validate serial number as string to work around libxml2 limitation

Make the Issuer on the Response Optional

OneLogin's SAML Python Toolkit v2.2.1

This version includes improvements oriented to help the developer to debug.

Changelog:

#175 Optionally raise detailed exceptions vs. returning False. Implement a more specific exception class for handling some validation errors. Improve/Fix tests

#171 Add hooks to retrieve last-sent and last-received requests and responses

Improved inResponse validation on Responses

#173 Fix attributeConsumingService serviceName format in README

OneLogin's SAML Python Toolkit v2.2.0

This version includes a security patch that contains extra validations that will prevent signature wrapping attacks.
... (truncated)

Changelog

Sourced from python-saml's changelog.

2.4.0 (Feb 27, 2018)

Fix vulnerability CVE-2017-11427. Process text of nodes properly, ignoring comments

Improve how fingerprint is calcultated

Fix issue with LogoutRequest rejected by ADFS due NameID with unspecified format instead no format attribute

Be able to invalidate a SAMLResponse if it contains InResponseTo value but no RequestId parameter provided at the is_valid method. See rejectUnsolicitedResponsesWithInResponseTo security parameter (By default deactivated)

Fix signature position in the SP metadata

Redefine NSMAP constant

2.3.0 (Sep 15, 2017)

#205 Improve decrypt method, Add an option to decrypt an element in place or copy it before decryption.

#204 On a LogoutRequest if the NameIdFormat is entity, NameQualifier and SPNameQualifier will be ommited. If the NameIdFormat is not entity and a NameQualifier is provided, then the SPNameQualifier will be also added.

Be able to get at the auth object the last processed ID (response/assertion) and the last generated ID.

Reset errorReason attribute of the auth object before each Process method

Fix issue on getting multiple certs when only sign or encryption certs

Allow empty nameid if setting wantNameId is false. Only raise Exceptions when strict mode is enabled

2.2.3 (Jun 15, 2017)

Replace some etree.tostring calls, that were introduced recfently, by the sanitized call provided by defusedxml

Update dm.xmlsec.binding requirement to 1.3.3 version

2.2.2 (May 18, 2017)

Be able to relax SSL Certificate verification when retrieving idp metadata

#195 Be able to register future SP x509cert on the settings and publish it on SP metadata

#195 Be able to register more than 1 Identity Provider x509cert, linked with an specific use (signing or encryption

#195 Allow metadata to be retrieved from source containing data of multiple entities

#195 Adapt IdP XML metadata parser to take care of multiple IdP certtificates and be able to inject the data obtained on the settings.

#194 Publish KeyDescriptor[use=encryption] only when required

#190 Checking the status of response before assertion count

Add Pyramid demo example

Allows underscores in URL hosts

NameID Format improvements

#184 Be able to provide a NameIDFormat to LogoutRequest

#180 Add DigestMethod support. (Add sign_algorithm and digest_algorithm parameters to sign_metadata and add_sign)

Validate serial number as string to work around libxml2 limitation

Make the Issuer on the Response Optional

2.2.1 (Jan 11, 2017)

#175 Optionally raise detailed exceptions vs. returning False. Implement a more specific exception class for handling some validation errors. Improve/Fix tests

#171 Add hooks to retrieve last-sent and last-received requests and responses

Improved inResponse validation on Responses

#173 Fix attributeConsumingService serviceName format in README

2.2.0 (Oct 14, 2016)

Several security improvements:

Conditions element required and unique.

AuthnStatement element required and unique.

SPNameQualifier must math the SP EntityID

... (truncated)

Commits

27bce00 Release 2.4.0
826f4f5 Improve how fingerprint is calcultated
fad881b Fix vulnerability CVE-2017-11427. Process text of nodes properly, ignoring co...
4081893 Be able to invalidate a SAMLResponse if it contains InResponseTo value but no...
6b9faf5 Redefine NSMAP constant
c8717ff Add more tests to cover IdPMetadataParser
032a2c7 Fix signature position in the SP metadata
265d019 Fix issue with LogoutRequest rejected by ADFS due NameID with unspecified for...
b089e78 Release 2.3.0
ef91db1 Improve previous commited tests
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Oct 03 '19 00:10 dependabot[bot]