xmlsec: re-enable KeyValue nodes when reading KeyInfo descriptors (#85339 )

KeyValue has been disabled in libxmlsec >= 1.3.3, as it can be a security liability in other settings than SAML: (xmlsec-core) Disabled KeyValue and DEREncodedKeyValue XML nodes by default. Use the '--enabled-key-data' option for the xmlsec command line utility or update the 'keyInfoCtx->enabledKeyData' parameter if you need to re-enable these nodes (also see question 3.5 in the FAQ).
xmlsec: use XMLSEC_KEYINFO_FLAGS_LAX_KEY_SEARCH when writing encrypted keys (#85339 )
2024-01-31 10:22:19 +01:00 · 2024-01-31 10:22:19 +01:00 · 2024-01-31 10:22:19 +01:00
1 changed files with 2 additions and 2 deletions
--- a/lasso/xml/tools.c
+++ b/lasso/xml/tools.c
@ -310,7 +310,7 @@ xmlSecKeyPtr lasso_get_public_key_from_pem_file(const char *file) {
 			pub_key = lasso_get_public_key_from_pem_cert_file(file);
 			break;
 		case LASSO_PEM_FILE_TYPE_PUB_KEY:
-#if LASSO_XMLSEC_VERSION_NUMBER > 0x010300
+#if LASSO_XMLSEC_VERSION_NUMBER >= 0x010300
 			pub_key = xmlSecCryptoAppKeyLoadEx(file, xmlSecKeyDataTypePublic | xmlSecKeyDataTypePrivate,
 					xmlSecKeyDataFormatPem, NULL, NULL, NULL);
 #else
@ -384,7 +384,7 @@ lasso_get_public_key_from_pem_cert_file(const char *pem_cert_file)
 static xmlSecKeyPtr
 lasso_get_public_key_from_private_key_file(const char *private_key_file)
 {
-#if LASSO_XMLSEC_VERSION_NUMBER > 0x010300
+#if LASSO_XMLSEC_VERSION_NUMBER >= 0x010300
 	return xmlSecCryptoAppKeyLoadEx(private_key_file, xmlSecKeyDataTypePrivate | xmlSecKeyDataTypePublic,
 			xmlSecKeyDataFormatPem, NULL, NULL, NULL);
 #else