billpatrianakos / saml2js Goto Github PK

View Code? Open in Web Editor NEW

This project forked from flesch/saml2json

3.0 3.0 14.0 362 KB

Parses SAML 2.0 responses into JS objects you can read and manipulate

License: Other

JavaScript 100.00%

saml2js's People

Contributors

Stargazers

Watchers

Forkers

andrewmaillet kinvey bgshacklett dennismphil brijeshgajjarfynd ryanhefner rapidops l1n vizirco ericauv riipen aashutoshrathi delivery-solutions jdbdnz

saml2js's Issues

npm audit warning

Please update the version of lodash. Seeing a npm audit warning

 npm audit    
                                                                                
                       === npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.17.11                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ saml2js                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ saml2js > lodash                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/782                             │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.17.5                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ saml2js                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ saml2js > lodash                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/577                             │
└───────────────┴──────────────────────────────────────────────────────────────┘

switch from xmldom to @xmldom/xmldom

xmldom is no longer maintained and is affected by https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39353

Please switch to https://www.npmjs.com/package/@xmldom/xmldom - the upgrade should be trivial as @xmldom/xmldom
is developed by the same team and is fully backwards compatible.

What am I doing wrong? I'm getting empty objects.

I'm trying to test the parser out prior to actually having everything wired up so I don't have a real response body to work with. Using the example XML snippet from the usage instructions, I am trying this:

const parser = new Saml2js(`<saml2:Attribute Name="First Name">
  <saml2:AttributeValue>John</saml2:AttributeValue>
</saml2:Attribute>`)

const samlObj = parser.toObject()
const samlJSON = parser.toJSON()
console.log('*** saml route samlObj: ', samlObj)
console.log('*** saml route samlJSON: ', samlJSON)
console.log(`*** saml route parser.get('first name'): `, parser.get('first name'))

My terminal output:

*** saml route samlObj:  {}
*** saml route samlJSON:  {}
*** saml route parser.get('first name'):  undefined

Leakage of result from previous run

Description

Ran into an issue using this library. If we invoke this twice, the result of the second instance is from the first invocation.

This is because profile is a global variable

var xmldom    = require('xmldom'),
    xpath     = require('xpath'),
    _         = require('lodash'),
    profile   = {};  // <------------------------ Culprit: Global Variable

// Saml2js
// -------
// Constructor function. Saves a copy
// of the raw SAML you pass to it and 
// a copy that's parsed into a JS object.
//
// `response` [String] - A SAML response string
function Saml2js (response) {
  this.rawSaml    = response;
  this.parsedSaml = this.parse(response);
}

README.md typo

HI there,

Thanks so much for putting this together. Am sure it will save me a load of time on the long run.

But just to let you know, the README.md has a typo, I think, in the section regarding toObject().

The sample code references "asObject()" ... which, of course, isn't a function.

Just spent a good 25 minutes wondering if I was mad or not.

Thanks

Neal

Documentation is wrong.

Your documentation says to execute parser.asObject() when the actual function is parser.toObject()

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.