xmlsec: re-enable KeyValue nodes when reading KeyInfo descriptors (#85339 )

KeyValue has been disabled in libxmlsec >= 1.3.3, as it can be a security liability in other settings than SAML: (xmlsec-core) Disabled KeyValue and DEREncodedKeyValue XML nodes by default. Use the '--enabled-key-data' option for the xmlsec command line utility or update the 'keyInfoCtx->enabledKeyData' parameter if you need to re-enable these nodes (also see question 3.5 in the FAQ).
xmlsec: use XMLSEC_KEYINFO_FLAGS_LAX_KEY_SEARCH when writing encrypted keys (#85339 )
2024-01-27 15:32:18 +01:00 · 2024-01-27 15:32:18 +01:00
1 changed files with 2 additions and 0 deletions
--- a/lasso/xml/xml.c
+++ b/lasso/xml/xml.c
@ -620,7 +620,9 @@ lasso_node_encrypt(LassoNode *lasso_node, xmlSecKey *encryption_public_key,
 		goto cleanup;
 	}

+#if (XMLSEC_MAJOR > 1) || (XMLSEC_MAJOR == 1 && XMLSEC_MINOR > 3) || (XMLSEC_MAJOR == 1 && XMLSEC_MINOR == 3 && XMLSEC_SUBMINOR >= 0)
 	enc_ctx->keyInfoWriteCtx.flags |= XMLSEC_KEYINFO_FLAGS_LAX_KEY_SEARCH;
+#endif

 	/* generate a symetric key */
 	switch (encryption_sym_key_type) {