security: remove debug dependency by ahacker1-securesaml · Pull Request #406 · node-saml/node-saml

ahacker1-securesaml · 2025-09-08T18:05:03Z

Description

Removes debug dependency, see https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised

while malware has been removed, we should be reducing dependencies in general to improve security (prevents threat of future compromise)

Summary by CodeRabbit

New Features
- Added a public method to generate service provider metadata for integrations.
Refactor
- Switched internal debug logging mechanism and reduced noisy logs; preserved runtime behavior.
- Minor error-message text correction in XML handling.
Chores
- Removed unused debug-related dependency.
- Tightened linting to treat console usage as an error.

coderabbitai · 2025-09-08T18:05:17Z

Caution

Review failed

The pull request is closed.

Walkthrough

Removed debug and @types/debug dependencies; replaced Debug-based logging with Node's util.debuglog (debugLog); added a PEM-resolution helper and a new public method SAML.generateServiceProviderMetadata; adjusted imports in XML handling; tightened ESLint no-console from "warn" to ["error"]. Core behaviors preserved.

Changes

Cohort / File(s)	Summary
Dependency cleanup `package.json`	Removed dependencies `debug` (`"^4.4.0"`) and `@types/debug` (`"^4.1.12"`) from `dependencies`.
SAML changes `src/saml.ts`	Replaced Debug logger with `util.debuglog` (`debugLog`); reorganized/expanded imports; added helper `resolveAndParseKeyInfosToPem` for resolving idpCert(s) to PEM strings; added public method `generateServiceProviderMetadata(this: SAML, decryptionCert: string
XML changes `src/xml.ts`	Replaced Debug logger with `util.debuglog` (`debugLog`); adjusted imports (added `@xmldom/is-dom-node`, `@xmldom/xmldom`, moved algorithms import); updated catch logging to use gated `debugLog`; fixed minor error message typo; no exported signatures changed.
Lint rule tightening `eslint.config.mjs`	Changed `no-console` rule for `*/.{js,ts}` from the string `"warn"` to the array `["error"]` (no other rule edits in this diff).

Sequence Diagram(s)

sequenceDiagram
  participant Caller as Consumer
  participant SAML as SAML.instance
  participant Module as saml module (generateServiceProviderMetadata)

  Note over SAML,Module #e6f7ff: New public method added to SAML class
  Caller->>SAML: generateServiceProviderMetadata(decryptionCert, publicCerts)
  SAML->>Module: generateServiceProviderMetadata(options + certs)
  Module-->>SAML: metadata XML string
  SAML-->>Caller: metadata XML string

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Poem

I hop through lines where secrets dwell,
I trade a noisy carrot for a quieter bell.
I stitch the PEMs, a tidy little feat,
A metadata ribbon, neat and sweet.
Bunny approves — small changes, light feet. 🐇✨

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 668c502 and 69ca9c5.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (4)

eslint.config.mjs (1 hunks)
package.json (0 hunks)
src/saml.ts (3 hunks)
src/xml.ts (4 hunks)

✨ Finishing touches

📝 Generate Docstrings

🧪 Generate unit tests

Create PR with unit tests
Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🧹 Nitpick comments (1)

src/saml.ts (1)
866-872: Remove leftover commented debug call (non-blocking).

Since the debug dependency is gone, keep the catch clean to avoid confusion.
-      // debug("validatePostResponse resulted in an error: %s", err);

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 1d8d66f and deb3413.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

package.json (0 hunks)
src/saml.ts (1 hunks)
src/xml.ts (1 hunks)

💤 Files with no reviewable changes (1)

package.json

🧰 Additional context used

🪛 GitHub Actions: Build Status

src/xml.ts

[error] 242-242: ESLint: 'err' is defined but never used. (@typescript-eslint/no-unused-vars)

src/xml.ts

markstos

I agree with the rationale here.

And while leaving commented out code usually is a code smell. Here it's helpful if we want to temporarily add back a debug function.

Another option would be a zero-dependency equivalent, like:

if (process.env.DEBUG='true') {
   console.error('Some debug logging');
}

@cjbarth Which approach appeals to you?

cjbarth · 2025-09-11T16:46:17Z

@markstos , why wouldn't we just use console.debug()? For cases where we aren't serializing a lot of data, the overhead should be minimal. It would be nice to get rid of that dependency (unless we're going to go full-in on it).

This is preferable to me than uncommented code because this is a library and I doubt people will be modifying the code just to do some testing/debugging.

ahacker1-securesaml · 2025-09-11T16:49:24Z

I left it commented out, so maintainers can choose a strategy that is best.

Let's use console.debug:

if (process.env.NODE_SAML_DEBUG='true') {
   console.debug('Some debug logging');
}

or

console.debug('...')

cjbarth · 2025-09-11T16:51:29Z

There's no need for the if guard IMO.

ahacker1-securesaml · 2025-09-11T16:54:38Z

Looks good to me!

coderabbitai

Actionable comments posted: 1

🧹 Nitpick comments (2)

eslint.config.mjs (2)
38-38: Consider util.debuglog for opt‑in, namespaced debug without an env guard.
Keeps zero dependency, avoids unconditional stdout in libraries, and mirrors debug’s opt‑in via NODE_DEBUG=node-saml.

TypeScript example (outside this file):
import { debuglog } from "node:util";
const debug = debuglog("node-saml");

// Usage:
debug("validatePostResponse resulted in an error: %s", err);
38-38: Optional: relax console rules in tests/fixtures.
If your tests or sample code use console.log/info/trace, consider disabling no-console just for **/*.spec.{js,ts} or adding those methods to allow in that block to reduce friction.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between f205a75 and a2600fd.

📒 Files selected for processing (3)

eslint.config.mjs (1 hunks)
src/saml.ts (1 hunks)
src/xml.ts (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (2)

src/saml.ts
src/xml.ts

🔇 Additional comments (1)

eslint.config.mjs (1)

38-38: Console policy tightened to allow only debug/warn/error — aligns with removing debug. LGTM.
This matches the move to console.debug while still blocking noisy console.log/info.

eslint.config.mjs

coderabbitai

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

src/xml.ts (1)
225-235: Missing XPath-injection guard in validateXmlSignatureWithPemFile.

Unlike getVerifiedXml(), this path interpolates refId into an XPath literal without rejecting quotes. A crafted refId containing ' or " could alter the XPath and defeat the intended check. Add the same guard here before building the XPath.
   const refId = refUri[0] === "#" ? refUri.substring(1) : refUri;
+  // prevent XPath injection
+  if (refId.includes("'") || refId.includes('"')) {
+    throw new Error("ref URI included quote character ' or \". Not a valid ID, and not allowed");
+  }
   // If we can't find the reference at the top level, reject
   const idAttribute = currentNode.getAttribute("ID") ? "ID" : "Id";

🧹 Nitpick comments (3)

src/xml.ts (2)
136-138: Typo in error message ("it's" → "its").

Minor user-facing string polish.
-      throw new Error("Invalid signature: Referenced node does not refer to it's parent element");
+      throw new Error("Invalid signature: Referenced node does not refer to its parent element");
241-246: Optional: enrich debug detail while keeping noise contained.

Log stack/message discriminately; still silent unless NODE_DEBUG matches.
-  } catch (err) {
-    debugLog("signature check resulted in an error: %s", err);
+  } catch (err) {
+    debugLog(
+      "signature check resulted in an error: %s",
+      err instanceof Error ? (err.stack ?? err.message) : util.inspect(err),
+    );
     return false;
   }
src/saml.ts (1)

653-665: Cache semantics OK; consider deduping PEMs (optional).

If upstream returns duplicates, you can normalize once to reduce work in .some() checks. Low impact.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between a2600fd and 668c502.

📒 Files selected for processing (3)

eslint.config.mjs (1 hunks)
src/saml.ts (3 hunks)
src/xml.ts (3 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

eslint.config.mjs

🧰 Additional context used

🧬 Code graph analysis (1)

src/saml.ts (1)

test/tests.spec.ts (8)

saml (3295-3310)

samlConfig (561-582)

samlConfig (450-466)

samlConfig (662-682)

samlConfig (584-602)

samlConfig (540-559)

samlConfig (684-728)

samlConfig (1613-1638)

🔇 Additional comments (6)

src/xml.ts (2)

20-20: Good swap to util.debuglog("node-saml").

Removes third-party risk; zero-cost when NODE_DEBUG is unset.

121-126: Nice: XPath injection guard on refId.

This mirrors the project’s prior hardening and is worth keeping.

src/saml.ts (4)

48-49: Good move to util.debuglog.

Aligns with library use (no console.* and opt-in via NODE_DEBUG).

868-874: LGTM: debug-only error logging with proper cache cleanup and rethrow.

Behavior preserved; logging is opt-in.

1356-1362: Scope check: new public API generateServiceProviderMetadata().

This is a semver-minor public surface addition unrelated to “remove debug.” Confirm it’s intentionally part of this PR and update changelog/docs accordingly. Tests already exercise it (good).

53-72: IdP cert callback signature confirmed — promisify usage is correct.
IdpCertCallback is defined as (callback: (err: Error | null, publicCert?: string | string[]) => void) => void in src/types.ts:78 and tests (test/samlTests.spec.ts — e.g. lines ~108,122,135,195) call it with a single cb; util.promisify(idpCert as IdpCertCallback)() is appropriate.

cjbarth · 2025-09-11T17:47:17Z

225-235: Missing XPath-injection guard in validateXmlSignatureWithPemFile.

Unlike getVerifiedXml(), this path interpolates refId into an XPath literal without rejecting quotes. A crafted refId containing ' or " could alter the XPath and defeat the intended check. Add the same guard here before building the XPath.
   const refId = refUri[0] === "#" ? refUri.substring(1) : refUri;
+  // prevent XPath injection
+  if (refId.includes("'") || refId.includes('"')) {
+    throw new Error("ref URI included quote character ' or \". Not a valid ID, and not allowed");
+  }
   // If we can't find the reference at the top level, reject
   const idAttribute = currentNode.getAttribute("ID") ? "ID" : "Id";

@ahacker1-securesaml or @srd90, what do you think of this suggestion from coderabbitai?

ahacker1-securesaml · 2025-09-11T17:49:55Z

validateXmlSignatureWithPemFile

I believe that this was an old method used to verify signatures. Now we have getVerifiedXML(), which has been tested to work. we can remove the old method, and replace usages with getVerifiedXML(). I will do this in a separate PR.

cjbarth · 2025-09-11T17:51:51Z

@coderabbitai review

coderabbitai · 2025-09-11T17:51:58Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

* Bump xml-encryption from 3.0.1 to 3.0.2 (node-saml#236) Bumps [xml-encryption](https://github.com/auth0/node-xml-encryption) from 3.0.1 to 3.0.2. - [Release notes](https://github.com/auth0/node-xml-encryption/releases) - [Commits](https://github.com/auth0/node-xml-encryption/commits) --- updated-dependencies: - dependency-name: xml-encryption dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump xml2js from 0.4.23 to 0.5.0 (node-saml#268) Bumps [xml2js](https://github.com/Leonidas-from-XIV/node-xml2js) from 0.4.23 to 0.5.0. - [Release notes](https://github.com/Leonidas-from-XIV/node-xml2js/releases) - [Commits](https://github.com/Leonidas-from-XIV/node-xml2js/commits/0.5.0) --- updated-dependencies: - dependency-name: xml2js dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Release 4.0.4 * Update minor dependencies (node-saml#269) * Improve audience mismatch error message (node-saml#257) * feat: add public getAuthorizeMessage method (node-saml#235) * Acknowledge that XML can be parsed to `any` (node-saml#271) * feat: support additionalParams on HTTP-POST binding (node-saml#263) * Make `callbackUrl` manditory (node-saml#214) * Add public key support (node-saml#225) Co-authored-by: Chris Barth <chrisjbarth@hotmail.com> * Remove types specific to Passport (node-saml#226) * Export types required for SamlOptions (node-saml#224) * Bump vm2 from 3.9.16 to 3.9.19 (node-saml#277) Bumps [vm2](https://github.com/patriksimek/vm2) from 3.9.16 to 3.9.19. - [Release notes](https://github.com/patriksimek/vm2/releases) - [Changelog](https://github.com/patriksimek/vm2/blob/master/CHANGELOG.md) - [Commits](patriksimek/vm2@3.9.16...3.9.19) --- updated-dependencies: - dependency-name: vm2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump json5 from 2.2.1 to 2.2.3 (node-saml#244) Bumps [json5](https://github.com/json5/json5) from 2.2.1 to 2.2.3. - [Release notes](https://github.com/json5/json5/releases) - [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md) - [Commits](json5/json5@v2.2.1...v2.2.3) --- updated-dependencies: - dependency-name: json5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump prettier from 2.8.7 to 2.8.8 (node-saml#274) Bumps [prettier](https://github.com/prettier/prettier) from 2.8.7 to 2.8.8. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@2.8.7...2.8.8) --- updated-dependencies: - dependency-name: prettier dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @typescript-eslint/parser from 5.58.0 to 5.59.8 (node-saml#281) Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 5.58.0 to 5.59.8. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.59.8/packages/parser) --- updated-dependencies: - dependency-name: "@typescript-eslint/parser" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump codecov/codecov-action from 3.1.1 to 3.1.4 (node-saml#279) Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 3.1.1 to 3.1.4. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@v3.1.1...v3.1.4) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Update minor dependencies (node-saml#283) * Roll-up changelog entries for beta releases (node-saml#282) * Fix spelling and normalize naming (node-saml#278) * Remove express dependency (node-saml#284) * Prefer Chai `expect` to Node `assert` (node-saml#286) * Add test coverage (node-saml#287) * Separate linting out from testing (node-saml#288) * Remove dependency on Passport types (node-saml#296) * Add tests for XML parsing with comments (node-saml#285) * Bump concurrently from 7.6.0 to 8.2.0 (node-saml#290) Bumps [concurrently](https://github.com/open-cli-tools/concurrently) from 7.6.0 to 8.2.0. - [Release notes](https://github.com/open-cli-tools/concurrently/releases) - [Commits](open-cli-tools/concurrently@v7.6.0...v8.2.0) --- updated-dependencies: - dependency-name: concurrently dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @typescript-eslint/parser from 5.59.9 to 5.60.1 (node-saml#292) Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 5.59.9 to 5.60.1. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.60.1/packages/parser) --- updated-dependencies: - dependency-name: "@typescript-eslint/parser" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump typescript from 4.8.4 to 5.1.6 (node-saml#293) Bumps [typescript](https://github.com/Microsoft/TypeScript) from 4.8.4 to 5.1.6. - [Release notes](https://github.com/Microsoft/TypeScript/releases) - [Commits](https://github.com/Microsoft/TypeScript/commits) --- updated-dependencies: - dependency-name: typescript dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Allow 5.x series for TypeScript --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump sinon from 14.0.2 to 15.2.0 (node-saml#294) Bumps [sinon](https://github.com/sinonjs/sinon) from 14.0.2 to 15.2.0. - [Release notes](https://github.com/sinonjs/sinon/releases) - [Changelog](https://github.com/sinonjs/sinon/blob/main/docs/changelog.md) - [Commits](sinonjs/sinon@v14.0.2...v15.2.0) --- updated-dependencies: - dependency-name: sinon dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump word-wrap from 1.2.3 to 1.2.4 (node-saml#298) Bumps [word-wrap](https://github.com/jonschlinkert/word-wrap) from 1.2.3 to 1.2.4. - [Release notes](https://github.com/jonschlinkert/word-wrap/releases) - [Commits](jonschlinkert/word-wrap@1.2.3...1.2.4) --- updated-dependencies: - dependency-name: word-wrap dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @typescript-eslint/parser from 5.59.9 to 5.62.0 (node-saml#299) Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 5.59.9 to 5.62.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.62.0/packages/parser) --- updated-dependencies: - dependency-name: "@typescript-eslint/parser" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @xmldom/xmldom from 0.8.8 to 0.8.10 (node-saml#301) Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) from 0.8.8 to 0.8.10. - [Release notes](https://github.com/xmldom/xmldom/releases) - [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md) - [Commits](xmldom/xmldom@0.8.8...0.8.10) --- updated-dependencies: - dependency-name: "@xmldom/xmldom" dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @typescript-eslint/eslint-plugin from 5.59.9 to 5.62.0 (node-saml#302) Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 5.59.9 to 5.62.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v5.62.0/packages/eslint-plugin) --- updated-dependencies: - dependency-name: "@typescript-eslint/eslint-plugin" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @types/node from 14.18.50 to 14.18.53 (node-saml#303) Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 14.18.50 to 14.18.53. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump @cjbarth/github-release-notes from 4.0.0 to 4.1.0 (node-saml#304) Bumps [@cjbarth/github-release-notes](https://github.com/cjbarth/github-release-notes) from 4.0.0 to 4.1.0. - [Release notes](https://github.com/cjbarth/github-release-notes/releases) - [Changelog](https://github.com/cjbarth/github-release-notes/blob/master/CHANGELOG.md) - [Commits](cjbarth/github-release-notes@4.0.0...4.1.0) --- updated-dependencies: - dependency-name: "@cjbarth/github-release-notes" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump release-it from 15.11.0 to 16.1.3 (node-saml#305) Bumps [release-it](https://github.com/release-it/release-it) from 15.11.0 to 16.1.3. - [Release notes](https://github.com/release-it/release-it/releases) - [Changelog](https://github.com/release-it/release-it/blob/main/CHANGELOG.md) - [Commits](release-it/release-it@15.11.0...16.1.3) --- updated-dependencies: - dependency-name: release-it dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump eslint from 8.42.0 to 8.45.0 (node-saml#306) Bumps [eslint](https://github.com/eslint/eslint) from 8.42.0 to 8.45.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](eslint/eslint@v8.42.0...v8.45.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump prettier-plugin-packagejson from 2.4.3 to 2.4.5 (node-saml#307) Bumps [prettier-plugin-packagejson](https://github.com/matzkoh/prettier-plugin-packagejson) from 2.4.3 to 2.4.5. - [Release notes](https://github.com/matzkoh/prettier-plugin-packagejson/releases) - [Commits](matzkoh/prettier-plugin-packagejson@v2.4.3...v2.4.5) --- updated-dependencies: - dependency-name: prettier-plugin-packagejson dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump prettier from 2.8.8 to 3.0.0 (node-saml#300) Bumps [prettier](https://github.com/prettier/prettier) from 2.8.8 to 3.0.0. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@2.8.8...3.0.0) --- updated-dependencies: - dependency-name: prettier dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Lint --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Chris Barth <chrisjbarth@hotmail.com> * Merge pull request from GHSA-vx8m-6fhw-pccw * Added verifyLogoutRequest to validatePostRequestAsync flow * Added bad expiration test * Updated IssueInstance to be in the past * Enforce valid setting for validateInResponseTo (node-saml#314) * Add test coverage for initialize() of saml.ts (node-saml#327) * Fixes `node-saml` not checking all `Audience`s in an `AudienceRestriction` (node-saml#340) * Upgrade to latest version of xml-crypto (node-saml#341) * Update to current Node versions (node-saml#342) * Fix metadata order (node-saml#334) Use the element order defined by "saml-schema-metadata-2.0.xsd" Closes node-saml#333 * Export generateServiceProviderMetadata (node-saml#337) * Rename `cert` to `idpCert` and `signingCert` to `publicCert` (node-saml#343) * Added X509 certificate to KeyInfo X509Data, if passed through options (node-saml#36) Co-authored-by: Ganesh Kshirsagar <ganesh.kshirsagar@nice.com> Co-authored-by: Barry Hagan <barryhagan@gmail.com> Co-authored-by: Chris Barth <chrisjbarth@hotmail.com> * Update minor dependencies and Node to 18 (node-saml#344) * Bump actions/checkout from 3 to 4 (node-saml#330) Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v3...v4) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump sinon and @types/sinon (node-saml#349) Bumps [sinon](https://github.com/sinonjs/sinon) and [@types/sinon](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/sinon). These dependencies needed to be updated together. Updates `sinon` from 15.2.0 to 17.0.1 - [Release notes](https://github.com/sinonjs/sinon/releases) - [Changelog](https://github.com/sinonjs/sinon/blob/main/docs/changelog.md) - [Commits](sinonjs/sinon@v15.2.0...v17.0.1) Updates `@types/sinon` from 10.0.20 to 17.0.3 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/sinon) --- updated-dependencies: - dependency-name: sinon dependency-type: direct:development update-type: version-update:semver-major - dependency-name: "@types/sinon" dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump eslint-plugin-deprecation from 1.5.0 to 2.0.0 (node-saml#347) Bumps [eslint-plugin-deprecation](https://github.com/gund/eslint-plugin-deprecation) from 1.5.0 to 2.0.0. - [Release notes](https://github.com/gund/eslint-plugin-deprecation/releases) - [Changelog](https://github.com/gund/eslint-plugin-deprecation/blob/master/CHANGELOG.md) - [Commits](gund/eslint-plugin-deprecation@v1.5.0...v2.0.0) --- updated-dependencies: - dependency-name: eslint-plugin-deprecation dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump eslint-config-prettier from 8.10.0 to 9.1.0 (node-saml#345) Bumps [eslint-config-prettier](https://github.com/prettier/eslint-config-prettier) from 8.10.0 to 9.1.0. - [Changelog](https://github.com/prettier/eslint-config-prettier/blob/main/CHANGELOG.md) - [Commits](prettier/eslint-config-prettier@v8.10.0...v9.1.0) --- updated-dependencies: - dependency-name: eslint-config-prettier dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump eslint-plugin-prettier from 4.2.1 to 5.1.3 (node-saml#346) Bumps [eslint-plugin-prettier](https://github.com/prettier/eslint-plugin-prettier) from 4.2.1 to 5.1.3. - [Release notes](https://github.com/prettier/eslint-plugin-prettier/releases) - [Changelog](https://github.com/prettier/eslint-plugin-prettier/blob/master/CHANGELOG.md) - [Commits](prettier/eslint-plugin-prettier@v4.2.1...v5.1.3) --- updated-dependencies: - dependency-name: eslint-plugin-prettier dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump release-it from 16.3.0 to 17.0.5 (node-saml#348) Bumps [release-it](https://github.com/release-it/release-it) from 16.3.0 to 17.0.5. - [Release notes](https://github.com/release-it/release-it/releases) - [Changelog](https://github.com/release-it/release-it/blob/main/CHANGELOG.md) - [Commits](release-it/release-it@16.3.0...17.0.5) --- updated-dependencies: - dependency-name: release-it dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Release 5.0.0 * Update sponsor acknowledgements (node-saml#365) * Docs: add pitch to encourage more sponsors (node-saml#366) * feat: improve error messages when validating pems (node-saml#373) * docs: Update README.md set never default validateInResponseTo (node-saml#384) * Adjust to support type stripping (node-saml#389) * Update xml-crypto to address CVE (node-saml#388) This update addresses the following CVE: CVE-2025-29774; CVE-2025-29775 * Release 5.0.1 * Update dependencies (node-saml#391) * Adjust linting rules for line endings (node-saml#393) * Export custom SamlStatusError (node-saml#394) * add CI test & lint for Node.js 22 (node-saml#386) * Use new .signedReferences interace in xml-crypto to "see what is signed" (node-saml#397) * Update sponsors: Stytch (node-saml#395) * Release 5.1.0 * Update to support Node strip-only TypeScript support (node-saml#407) * Security: remove debug dependency (node-saml#406) * ARCH-32 node_saml changes * ARCH-32_fixed test * ARCH-32 updated the review comments * ARCH-32 package.json changes * ARCH-32 updated package json * ARCH-32 access to public * upgraded circleci node version to 22 * updated yarn.lock * removed package-lock.json * reset config.yml except for node version * reset workflow.yml * added 22.x to node-version matrix * fixed package-lock.json * fixed package-lock.json and yarn.lock * fixed node version number in package.json --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Chris Barth <chrisjbarth@hotmail.com> Co-authored-by: gmhewett <gmhewett@users.noreply.github.com> Co-authored-by: aykutbulca <aykutbulca@gmail.com> Co-authored-by: Gert Sallaerts <1267900+GertSallaerts@users.noreply.github.com> Co-authored-by: RopoMen <RopoMen@users.noreply.github.com> Co-authored-by: jindazhao01 <137830289+jindazhao01@users.noreply.github.com> Co-authored-by: Adam Andreasson <hej@adamandreasson.se> Co-authored-by: 56 <kg0r0@yahoo.co.jp> Co-authored-by: Nikolay <catamphetamine@users.noreply.github.com> Co-authored-by: Salvador Ortiz <sog@msg.mx> Co-authored-by: Nathan Sarang-Walters <nwalters512@gmail.com> Co-authored-by: Ganesh Kshirsagar <ganeshakshirsagar@gmail.com> Co-authored-by: Ganesh Kshirsagar <ganesh.kshirsagar@nice.com> Co-authored-by: Barry Hagan <barryhagan@gmail.com> Co-authored-by: Mark Stosberg <mark@rideamigos.com> Co-authored-by: Kilian Finger <hey@kilianfinger.com> Co-authored-by: Kiran Mali <39133739+kdhttps@users.noreply.github.com> Co-authored-by: Manan Jadhav <166636237+manan-jadhav-ab@users.noreply.github.com> Co-authored-by: ahacker1 <alex@securesaml.com> Co-authored-by: howard-stytch <89414701+howard-stytch@users.noreply.github.com> Co-authored-by: suriyaka <106838750+suriyaka@users.noreply.github.com>

security: remove debug dependency

deb3413

coderabbitai bot reviewed Sep 8, 2025

View reviewed changes

src/xml.ts Outdated Show resolved Hide resolved

markstos reviewed Sep 10, 2025

View reviewed changes

Merge remote-tracking branch 'origin/master' into pr/406

f205a75

Adjust to use console.debug()

4bdc3b7

Adjust eslint config

a2600fd

coderabbitai bot reviewed Sep 11, 2025

View reviewed changes

eslint.config.mjs Outdated Show resolved Hide resolved

cjbarth added 2 commits September 11, 2025 12:20

Use util.debuglog() instead of console.log()

668c502

Fix eslint syntax.

276dc4f

coderabbitai bot reviewed Sep 11, 2025

View reviewed changes

cjbarth added 3 commits September 11, 2025 12:30

Remove @types/debug

f454017

Establish pattern for lazy debug evaluation

949d5d9

Undo unrelated change to dependency

69ca9c5

cjbarth added dependencies Relating to updating dependencies chore labels Sep 11, 2025

cjbarth merged commit 25c434a into node-saml:master Sep 11, 2025
11 checks passed

AlbertPangilinan pushed a commit to Foxquilt/foxden-node-saml that referenced this pull request Sep 22, 2025

Security: remove debug dependency (node-saml#406)

c75d320

Conversation

ahacker1-securesaml commented Sep 8, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Sep 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Poem

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

markstos left a comment

Choose a reason for hiding this comment

Uh oh!

cjbarth commented Sep 11, 2025

Uh oh!

ahacker1-securesaml commented Sep 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cjbarth commented Sep 11, 2025

Uh oh!

ahacker1-securesaml commented Sep 11, 2025

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

cjbarth commented Sep 11, 2025

Uh oh!

ahacker1-securesaml commented Sep 11, 2025

Uh oh!

cjbarth commented Sep 11, 2025

Uh oh!

coderabbitai bot commented Sep 11, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ahacker1-securesaml commented Sep 8, 2025 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Sep 8, 2025 •

edited

Loading

ahacker1-securesaml commented Sep 11, 2025 •

edited

Loading