From 49741c66adafd63cd3de6ca82c37bd79158f7626 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Wed, 27 Feb 2019 11:47:07 +0000
Subject: [PATCH] Check children of Extensions element against registration
 policy

See ukf/ukf-meta#180.
---
 mdx/uk/beans.xml               |   8 +++
 mdx/uk/check_uk_extensions.xsl | 100 +++++++++++++++++++++++++++++++++
 mdx/uk/verbs.xml               |   1 +
 3 files changed, 109 insertions(+)
 create mode 100644 mdx/uk/check_uk_extensions.xsl

diff --git a/mdx/uk/beans.xml b/mdx/uk/beans.xml
index 30fd7d53..d58cbfc0 100644
--- a/mdx/uk/beans.xml
+++ b/mdx/uk/beans.xml
@@ -240,6 +240,13 @@
         p:XSLResource="classpath:uk/check_uk_keydesc_key.xsl"/>
 
 
+    <!--
+        check_uk_extensions
+    -->
+    <bean id="check_uk_extensions" parent="mda.XSLValidationStage"
+        p:XSLResource="classpath:uk/check_uk_extensions.xsl"/>
+
+
     <!--
         check_uk_mdattr
     -->
@@ -359,6 +366,7 @@
                 <ref bean="check_owner"/>
                 <ref bean="check_uk_keydesc_key"/>
                 <ref bean="check_uk_mdattr"/>
+                <ref bean="check_uk_extensions"/>
                 <ref bean="check_uk_mdrps"/>
                 <ref bean="check_uk_urlenc"/>
                 <ref bean="check_uk_mdui_dn_en_present"/>
diff --git a/mdx/uk/check_uk_extensions.xsl b/mdx/uk/check_uk_extensions.xsl
new file mode 100644
index 00000000..56ef2322
--- /dev/null
+++ b/mdx/uk/check_uk_extensions.xsl
@@ -0,0 +1,100 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+    check_uk_extensions.xsl
+
+    UKf-specific check for supported elements in Extensions elements.
+-->
+<xsl:stylesheet version="1.0"
+    xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+    xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
+    xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init"
+    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+    xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+    xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi"
+    xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
+    xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
+    xmlns:ukfedlabel="http://ukfederation.org.uk/2006/11/label"
+
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+    xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
+
+    <!--
+        Common support functions.
+    -->
+    <xsl:import href="../_rules/check_framework.xsl"/>
+
+    <!--
+        The default is to treat all children of an md:Extensions element
+        in any location as an error.
+
+        This template matches *all* extension elements. It will be overridden
+        by matches for specific whitelisted extension elements at a
+        *higher priority*. It is an error for a node to match two templates
+        with the same priority, so we set the priority of this rule to -1.
+    -->
+    <xsl:template match="md:Extensions/*" priority="-1">
+        <xsl:call-template name="error">
+            <xsl:with-param name="m">
+                <xsl:text>Unsupported extension element </xsl:text>
+                <xsl:value-of select="name()"/>
+                <xsl:text> within </xsl:text>
+                <xsl:value-of select="name(../..)"/>
+            </xsl:with-param>
+        </xsl:call-template>
+    </xsl:template>
+
+    <!--
+        Note: Algorithm Support metadata.
+
+        The SAML v2.0 Metadata Profile for Algorithm Support Version 1.0
+        specification allows the algorithm support metadata elements
+        (alg:DigestMethod and alg:SigningMethod) to appear either in the
+        md:EntityDescriptor's md:Extensions, or within the md:Extensions of
+        any role descriptor (e.g., md:SPSSODescriptor, md:IDPSSODescriptor).
+
+        The rule here, applied only to UK federation registrations, is more
+        strict in that these elements are only permitted within the
+        md:Extensions of an md:EntityDescriptor element. We have only ever seen
+        one exception to this stricter rule, and that was a result of a
+        registration mistake. We think it's therefore worth being less
+        permissive than the specification allows in this case.
+
+        See ukf/ukf-meta#180.
+    -->
+
+    <!--
+        Permitted extensions within md:EntityDescriptor.
+    -->
+    <xsl:template match="md:EntityDescriptor/md:Extensions/alg:DigestMethod"/>
+    <xsl:template match="md:EntityDescriptor/md:Extensions/alg:SigningMethod"/>
+    <xsl:template match="md:EntityDescriptor/md:Extensions/mdattr:EntityAttributes"/>
+    <xsl:template match="md:EntityDescriptor/md:Extensions/mdrpi:RegistrationInfo"/>
+    <xsl:template match="md:EntityDescriptor/md:Extensions/shibmd:Scope"/>
+    <xsl:template match="md:EntityDescriptor/md:Extensions/ukfedlabel:AccountableUsers"/>
+    <xsl:template match="md:EntityDescriptor/md:Extensions/ukfedlabel:ExportOptIn"/>
+    <xsl:template match="md:EntityDescriptor/md:Extensions/ukfedlabel:ExportOptOut"/>
+    <xsl:template match="md:EntityDescriptor/md:Extensions/ukfedlabel:Software"/>
+    <xsl:template match="md:EntityDescriptor/md:Extensions/ukfedlabel:UKFederationMember"/>
+
+    <!--
+        Permitted extensions within md:AttributeAuthorityDescriptor.
+    -->
+    <xsl:template match="md:AttributeAuthorityDescriptor/md:Extensions/shibmd:Scope"/>
+
+    <!--
+        Permitted extensions within md:IDPSSODescriptor.
+    -->
+    <xsl:template match="md:IDPSSODescriptor/md:Extensions/mdui:DiscoHints"/>
+    <xsl:template match="md:IDPSSODescriptor/md:Extensions/mdui:UIInfo"/>
+    <xsl:template match="md:IDPSSODescriptor/md:Extensions/shibmd:Scope"/>
+
+    <!--
+        Permitted extensions within md:SPSSODescriptor.
+    -->
+    <xsl:template match="md:SPSSODescriptor/md:Extensions/idpdisc:DiscoveryResponse"/>
+    <xsl:template match="md:SPSSODescriptor/md:Extensions/init:RequestInitiator"/>
+    <xsl:template match="md:SPSSODescriptor/md:Extensions/mdui:UIInfo"/>
+
+</xsl:stylesheet>
diff --git a/mdx/uk/verbs.xml b/mdx/uk/verbs.xml
index c5a88d82..a2875500 100644
--- a/mdx/uk/verbs.xml
+++ b/mdx/uk/verbs.xml
@@ -364,6 +364,7 @@
                     </property>
                 </bean>
 
+                <ref bean="check_uk_extensions"/>
                 <ref bean="check_uk_mdrps"/>
                 <ref bean="check_uk_urlenc"/>
                 <ref bean="check_future"/>