wai-saml2 0.7.0 → 0.7.1

raw patch · 5 files changed

+24/−5 lines, 5 filesPVP ok

version bump matches the API change (PVP)

API changes (from Hackage documentation)

Files

• CHANGELOG.md +4/−0
• README.md +2/−0
• SECURITY.md +11/−0
• src/Network/Wai/SAML2/Request.hs +1/−1
• wai-saml2.cabal +6/−4

@@ -1,5 +1,9 @@ # Changelog for `wai-saml2` +## 0.7.1++-   Fixed spelling of attribute `AllowCreate` in `NameIDPolicy` ([#88](https://github.com/mbg/wai-saml2/pull/88) by [@Philonous](https://github.com/Philonous))+ ## 0.7  -   Replaced `x509Certificate` with `x509Certificates` in `IDPSSODescriptor` so that it may have more than one certificate ([#65](https://github.com/mbg/wai-saml2/pull/65) by [@fumieval](https://github.com/fumieval))

@@ -23,6 +23,8 @@  * You __must not__ expose any errors to a client as that could severely compromise the security of the system as attackers may be able to use the errors to narrow down valid SAML responses. You __should__ log and monitor errors though as they may indicate attacks on your system. Ensure that log files containing errors from the SAML2 middleware are stored securely. +See also [SECURITY.md](SECURITY.md) for information about this library's security policy, including how to report a vulnerability if you have discovered one.+ ## Usage  ### Preliminaries

@@ -0,0 +1,11 @@+# Security Policy++## Reporting a Vulnerability++If you have discovered a vulnerability in this library, please [report it confidentially by creating a new security advisory for this repository on GitHub](https://github.com/mbg/wai-saml2/security/advisories/new). A [good template for reporting vulnerabilities](https://github.com/github/securitylab/blob/dc3f4357b72c2ed23020615117b431fe573b7134/docs/report-template.md) was put created by GitHub's Security Lab if you want to use it.++When reporting a vulnerability, please try to include enough instructions to allow the issue to be recreated. Please also include information about the potential impact of the vulnerability, any pre-conditions that need to be met. If you have a suggested remediation, we would be thankful if you include it as well.++If the vulnerability is confirmed, we will aim to fix it as soon as possible.++Once fixed, the security advisory you filed will be published publicly and you will be credited.

@@ -144,7 +144,7 @@         nameIdPolicy = Element             (saml2pName "NameIDPolicy")             (Map.fromList-                [ ("allowCreate"+                [ ("AllowCreate"                     , if authnRequestAllowCreate then "true" else "false")                 , ("Format", showNameIDFormat authnRequestNameIDFormat)                 ])

@@ -1,11 +1,11 @@-cabal-version: 1.12+cabal-version: 1.18 --- This file has been generated from package.yaml by hpack version 0.38.1.+-- This file has been generated from package.yaml by hpack version 0.39.6. -- -- see: https://github.com/sol/hpack  name:           wai-saml2-version:        0.7.0+version:        0.7.1 synopsis:       SAML2 assertion validation as WAI middleware description:    A Haskell library which implements SAML2 assertion validation as WAI middleware category:       Security@@ -19,7 +19,6 @@ build-type:     Simple extra-source-files:     README.md-    CHANGELOG.md     tests/data/azuread-signed-assertion.xml     tests/data/azuread-signed-response.xml     tests/data/azuread.crt@@ -35,6 +34,9 @@     tests/data/metadata/google.xml.expected     tests/data/metadata/keycloak.xml     tests/data/metadata/keycloak.xml.expected+extra-doc-files:+    CHANGELOG.md+    SECURITY.md  source-repository head   type: git