Skip to content

Commit acac9e9

Browse files
committed
Fix vulnerability: CVE-2025-25293: Potential DOS abusing of compressed messages.
1 parent 60627ba commit acac9e9

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

lib/onelogin/ruby-saml/saml_message.rb

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -93,10 +93,16 @@ def decode_raw_saml(saml, settings = nil)
9393

9494
decoded = decode(saml)
9595
begin
96-
inflate(decoded)
96+
message = inflate(decoded)
9797
rescue
98-
decoded
98+
message = decoded
9999
end
100+
101+
if message.bytesize > settings.message_max_bytesize
102+
raise ValidationError.new("Encoded SAML Message exceeds " + settings.message_max_bytesize.to_s + " bytes, so was rejected")
103+
end
104+
105+
message
100106
end
101107

102108
# Deflate, base64 encode and url-encode a SAML Message (To be used in the HTTP-redirect binding)

0 commit comments

Comments
 (0)