Merge pull request auth0#79 from ziluvatar/fix-signature-location

sec: fix signature location lookup

SECURITY-NOTICE.md

@@ -1,3 +1,27 @@
+Security vulnerability details for passport-wsfed-saml2 < 3.0.10
+===============================================================
+
+A vulnerability was found in the validation of a SAML signature. The validation doesn't ensure that the "Signature" tag is at the proper location inside an "Assertion" tag. This leads to a signature relocation attack where the attacker can corrupt one field of data while
+maintaining the signature valid. This could allow an authenticated attacker to "remove" one group from his assertion or corrupt another field of an assertion.
+
+Updated packages are available on npm. To ensure delivery of additional bug fixes moving forward, please make sure your `package.json` file is updated to take patch and minor level updates of our libraries. See below:
+
+```
+{
+  "dependencies": {
+    "passport-wsfed-saml2": "^3.0.10"
+  }
+}
+```
+
+## Upgrade Notes
+
+This fix patches the library that your application runs, but will not impact your users, their current state, or any existing sessions.
+
+You can read more details regarding the vulnerability [here](https://auth0.com/docs/security/bulletins/cve-2018-8085).
+
+
+
 Security vulnerability details for passport-wsfed-saml2 < 3.0.5
 ===============================================================
 

lib/passport-wsfed-saml2/saml.js

@@ -304,7 +304,7 @@ SAML.prototype.validateSamlAssertion = function (samlAssertion, callback) {
   self.validateSignature(samlAssertion.toString(), {
     cert: self.options.cert,
     thumbprints: self.options.thumbprints,
-    signaturePath: ".//*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']" }, function(err) {
+    signaturePath: "/*[local-name(.)='Assertion']/*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']" }, function(err) {
     if (err) return callback(err);
 
     self.parseAssertion(samlAssertion, callback);