Skip to content

Commit 5d45efb

Browse files
thesealtheseal
authored
Merge pull request #335 from IdentityPython/fix-keep-xs-ns-prefixes
Fix keep xs ns prefixes
2 parents 9ec26e1 + 55719c8 commit 5d45efb

5 files changed

Lines changed: 363 additions & 4 deletions

File tree

‎src/pyff/builtins.py‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -552,10 +552,6 @@ def _nop(x):
552552
out = output_file
553553
data = req.t
554554

555-
# clean unused namespaces - the working document isn't always XML (eg discojson* produce JSON)
556-
if isinstance(data, (etree._Element, etree._ElementTree)):
557-
etree.cleanup_namespaces(data)
558-
559555
if not req.args.get('raw'):
560556
data = dumptree(req.t, pretty_print=req.args.get('pretty_print'))
561557

‎src/pyff/samlmd.py‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
import json
2+
import re
23
import traceback
34
from base64 import b64decode
45
from copy import deepcopy
@@ -438,6 +439,35 @@ def _resolve(m, l_fn):
438439
return resolved_entities
439440

440441

442+
# A QName is NCName ":" NCName. Requiring a valid NCName local part rejects the
443+
# far more common URI-shaped attribute values ("https://..." has a '/' local part).
444+
_QNAME_RE = re.compile(r'^[A-Za-z_][\w.-]*:[A-Za-z_][\w.-]*$')
445+
446+
447+
def qname_prefixes(t):
448+
"""Namespace prefixes referenced from inside QName-valued attributes.
449+
450+
lxml.etree.cleanup_namespaces only considers prefixes used in element and
451+
attribute *names*, so a prefix appearing solely in an attribute *value* -
452+
xsi:type="xsd:string" being the common case - looks unused and gets removed,
453+
leaving a dangling QName that fails schema validation.
454+
"""
455+
keep = set()
456+
match = _QNAME_RE.match
457+
for elt in t.iter():
458+
values = elt.values()
459+
if not values:
460+
continue
461+
for value in values:
462+
if match(value):
463+
prefix = value.split(':', 1)[0]
464+
# Only keep prefixes actually bound here; anything else is either
465+
# not a QName or already-broken metadata.
466+
if prefix not in keep and prefix in elt.nsmap:
467+
keep.add(prefix)
468+
return keep
469+
470+
441471
def entitiesdescriptor(
442472
entities,
443473
name,
@@ -488,6 +518,12 @@ def entitiesdescriptor(
488518
ent_insert = deepcopy(ent_insert)
489519
t.append(ent_insert)
490520

521+
# Clean unused namespaces. Prefixes referenced only from QName-valued attributes
522+
# (xsi:type="xsd:string") are invisible to lxml's usage tracking, so collect and
523+
# preserve them explicitly - see issue #333.
524+
keep_ns_prefixes = qname_prefixes(t)
525+
etree.cleanup_namespaces(t, keep_ns_prefixes=keep_ns_prefixes)
526+
491527
if config.devel_write_xml_to_file:
492528
import os
493529

‎src/pyff/test/data/metadata/test05-xsd-prefix-idp.xml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsd="http://www.w3.org/2001/XMLSchema" entityID="https://auth.funktionstjanster.se/id/proxy/saml2/67cacd06db3b47c951eefdfa/idp/67cacbb7ef0f342709eefdf6/c/682f0e0f8dc75a89157ed724/authn">
3+
<md:Extensions>
4+
<mdattr:EntityAttributes>
5+
<saml2:Attribute Name="http://macedir.org/entity-category" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
6+
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">http://id.elegnamnden.se/ec/1.0/loa3-pnr</saml2:AttributeValue>
7+
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">http://id.elegnamnden.se/st/1.0/public-sector-sp</saml2:AttributeValue>
8+
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">http://id.elegnamnden.se/ec/1.0/eidas-naturalperson</saml2:AttributeValue>
9+
</saml2:Attribute>
10+
</mdattr:EntityAttributes>
11+
</md:Extensions>
12+
<md:SPSSODescriptor AuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
13+
<md:Extensions>
14+
<mdui:UIInfo xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui">
15+
<mdui:DisplayName xml:lang="sv">Kronofogdens e-tjänster</mdui:DisplayName>
16+
<mdui:DisplayName xml:lang="en">Swedish Enforcement Authority</mdui:DisplayName>
17+
<mdui:Description xml:lang="sv">Med hjälp av våra e-tjänster kan du utföra ärenden då det passar dig bäst. Om du har en personlig e-legitimation med personnummer kan du, dygnet runt, logga in och lämna uppgifter till oss.</mdui:Description>
18+
<mdui:Description xml:lang="en">With the help of our e-services, you can perform tasks whenever it suits you best. If you have an e-ID with personal identity number (personnummer), you can 24 hours 365 days provide information to us.</mdui:Description>
19+
<mdui:Logo height="38" width="247">https://www.kronofogden.se/images/18.4c1b677f134cb6b828f80003907/1371144387972/logotyp-header.png</mdui:Logo>
20+
</mdui:UIInfo>
21+
</md:Extensions>
22+
<md:KeyDescriptor use="signing">
23+
<ds:KeyInfo>
24+
<ds:X509Data>
25+
<ds:X509Certificate>MIIEljCCAn6gAwIBAgIUUJYcgA6FTGauUb/a7H6GsZ5SyzkwDQYJKoZIhvcNAQELBQAwSDELMAkGA1UEBhMCU0UxFzAVBgNVBAoTDkNHSSBTdmVyaWdlIEFCMSAwHgYDVQQDExdjYS5mdW5rdGlvbnN0amFuc3Rlci5zZTAeFw0yNTAzMDMxMzM0MDBaFw0zMzEyMzEyMzU5MDBaMF4xIjAgBgNVBAMTGWF1dGguZnVua3Rpb25zdGphbnN0ZXIuc2UxFzAVBgNVBAoTDkNHSSBTdmVyaWdlIEFCMQswCQYDVQQGEwJTRTESMBAGA1UECBMJU3RvY2tob2xtMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz/rj9iRa8JOJBXRpH+4tRlwb5xZdy/aot1k6+QAmWvhSuDByMV/S0eijqfuGENq4dKnZ95pI1C074WqkN94q35HbdT+5C8kxe+ydUeVINAvpQVvRGbo0o1rPVRRdbhkj/T/KmU0Xy9gKd1KxFOv69hBe35+0hB0yVzckO6c3vGnIyIgTVbMoxz8gZ98btEyx0Z/m7J2FE7Cg2xfwrxQVEiwUQr9jeMkH5axN6aCxj0Ch14IDLl8NXhzKvJD5KUH2nt5K7tRzdDAv9GnWjRy2INxqYx3QC9AoQcpE0Sc5bhjSYY9skVJCkCD9YtUNTrqYswLbXTJQ1idbmGByQOy5wwIDAQABo2IwYDAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBTxC/j/FcdqYpNS/+QIEERlqocadDALBgNVHQ8EBAMCA+gwJAYDVR0RBB0wG4IZYXV0aC5mdW5rdGlvbnN0amFuc3Rlci5zZTANBgkqhkiG9w0BAQsFAAOCAgEAsWs7B6Z8uSXPTz388OBG+OLo3vBCq5FOdow8IHzBpwbah+Ip/QLlO7q85o5uPSNglna5o5nS2D3LOfUsAhoPKYpA8vOTepEWfTLPVc6ZkyARbR+kqJlWpINjlKHlzp49YjvZhHaMsVae+8BfU1F+YIK0ArN4cBEZKFp7NafYoAb99YzdmCUyEdFRtgujAiBP8SiXLYiy04BqG8oh23OUBcOTV4KHmR9+VBMtoG31768nYzqqZTfGaXWzAsJzSOdSnmhAdRbm78oP25+lM80ZfzH0b+VqEIibCg5F8O9RYZ4aD06497M1J3Mt36nehZbAUFFCWgxOS10n6RMaZxyRtzGpVsZ5EgfFSQqM0k9IqAlm9qiHUIeg4dRI0qNY7NfeaJs8ucsHRDotGUkuJpeJpLjsSMud0eOCLKu5GUg68KOc/lA6FxdxikshA5CeB2Ull/vLk/ONXLZuD0JXhFfoqnUSQfc5zHZCrPf+H9e1LmKYpg3b82jNmHef8uhudg3DV0F0Oxe5mRrr9G0Im9dbK2nOPOw8Min0y7IsmKx+wsNhc5KSKVvGVIdPUCIOOzWmFT39WbKfXeQ3wPbEfk0WMshl69DcScHE6QipVW1e10kzgCxvXx19/yvAN0Gbf/6QAOUdIyp78I4WijMWwU4cWCbghaG0agK754M7ut2Hwnw=</ds:X509Certificate>
26+
</ds:X509Data>
27+
</ds:KeyInfo>
28+
<md:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes256-gcm"/>
29+
<md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
30+
</md:KeyDescriptor>
31+
<md:KeyDescriptor use="encryption">
32+
<ds:KeyInfo>
33+
<ds:X509Data>
34+
<ds:X509Certificate>MIIErDCCApSgAwIBAgIUThRHrydX8KwttHiKNPlrtADt9dAwDQYJKoZIhvcNAQELBQAwSDELMAkGA1UEBhMCU0UxFzAVBgNVBAoTDkNHSSBTdmVyaWdlIEFCMSAwHgYDVQQDExdjYS5mdW5rdGlvbnN0amFuc3Rlci5zZTAeFw0yNTA0MDcwODAwMDBaFw0zMzEyMzEyMzU5MDBaMGkxLTArBgNVBAMTJGVuY3J5cHRpb24uYXV0aC5mdW5rdGlvbnN0amFuc3Rlci5zZTEXMBUGA1UEChMOQ0dJIFN2ZXJpZ2UgQUIxCzAJBgNVBAYTAlNFMRIwEAYDVQQIEwlTdG9ja2hvbG0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDb+xAFrd+QR7/1cfiqPcLaFqRQVsnPgESQMYkOYbN1It9D18LldPYuSFL3KubWKYYbJ67nR5mS4ACDiwp0CAaVJU2hDO7mxfcblGFmEvd2UpwWIG44vpbEqHVCCuAccU62jj9bW9QL09urWRfy6J8nXtzxpgsrRVbujzj8mAFCXi/waWQu7N3cQQV4cVuBvJUy9RVgZ15gf8uty+cFhmloZYOGnGkPctkG8aC+n5g+OQx36Cs8IGbl6LRbvSlBAyiUCEeTY0erB+FIlkddyWtDVb/pok2RWxJRBm2VmKePKpB2ykcuvYOl4jn2efSlOkU8gqKF1+FH87SvO2WvaI4XAgMBAAGjbTBrMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFHftF0eMUzkskpcB/VKCZPURDDuBMAsGA1UdDwQEAwID6DAvBgNVHREEKDAmgiRlbmNyeXB0aW9uLmF1dGguZnVua3Rpb25zdGphbnN0ZXIuc2UwDQYJKoZIhvcNAQELBQADggIBAF1oFWsnrs69LTsMgcIXlBQClt/xlinWNeSytvXQhQYCgp6h1euLRLeTt4fY/jLTO4BMHppaQ5FPcVf8Se16+LJcxMoxUGeIjbjG8eVKrT1P+ks4fZVmwMevN1z0LMCAZO/N43rLBvBakv9L7wd8atCIRUEKYP8WlyMrb5hC7MD8wdGsBd6GYBGBmdkVdVwJEvmyi5MZnWsHTxJ/DH+vCbHP3kIzZ+6CuB2oGiy5ZIScCzkeMAOzRPoqx+3PETYs2uIr71ibd3AlRRbx/gO1aEze1Lt0qN5J97/l4qi34mrSJHBlbydmepZkZAA9q7lx2hQnxhRS45T6PavzVL5f6tlp4iR99Tqb9SaLOHx5l/q23TwOttRc8rZA3LZZ7kqjq+inQ8y1KHaqgsKZFuaAEzBnJslEfQvJt3/oOzLYPzfqyamBBv+yYwrTVKzZMXurlbjeP8r+ZIDbZsHNa2wJKXpBmcfzhyJ4n66M58jh+KmRPYu2KlKA4r1eiZ/vKYXGrPCsiuY/RItTlNlagyy3+yFJDQO/5MXfL9tuoGI6GkYyZJyc585U5IjGERqcCpNegLgCHSKK29HajafOz+zPeh5Sk2qGlOcG6uehRrFPg4cGDdSqY6WEHq0ZGvYjH0GjMbStgw52KCEoWiRgsqZDhoPgsSpghntXxV+brmGK1eDE</ds:X509Certificate>
35+
</ds:X509Data>
36+
</ds:KeyInfo>
37+
<md:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes256-gcm"/>
38+
<md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
39+
</md:KeyDescriptor>
40+
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://auth.funktionstjanster.se/id/proxy/saml2/67cacd06db3b47c951eefdfa/idp/67cacbb7ef0f342709eefdf6/c/682f0e0f8dc75a89157ed724/authn/slo/post"/>
41+
<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
42+
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://auth.funktionstjanster.se/id/proxy/saml2/67cacd06db3b47c951eefdfa/idp/67cacbb7ef0f342709eefdf6/c/682f0e0f8dc75a89157ed724/authn/sso/post" index="1" isDefault="true"/>
43+
</md:SPSSODescriptor>
44+
<md:Organization>
45+
<md:OrganizationName xml:lang="sv">Kronofogden</md:OrganizationName>
46+
<md:OrganizationName xml:lang="en">Swedish Enforcement Authority</md:OrganizationName>
47+
<md:OrganizationDisplayName xml:lang="sv">Kronofogden</md:OrganizationDisplayName>
48+
<md:OrganizationDisplayName xml:lang="en">Swedish Enforcement Authority</md:OrganizationDisplayName>
49+
<md:OrganizationURL xml:lang="sv">https://www.kronofogden.se/</md:OrganizationURL>
50+
</md:Organization>
51+
<md:ContactPerson contactType="technical">
52+
<md:EmailAddress>digitalatjanster.support@kronofogden.se</md:EmailAddress>
53+
</md:ContactPerson>
54+
<md:ContactPerson contactType="support">
55+
<md:EmailAddress>digitalatjanster.support@kronofogden.se</md:EmailAddress>
56+
</md:ContactPerson>
57+
</md:EntityDescriptor>

0 commit comments

Comments
 (0)