diff --git a/npm/package-lock.json b/npm/package-lock.json index 901311f6c..7335b24f2 100644 --- a/npm/package-lock.json +++ b/npm/package-lock.json @@ -14,7 +14,7 @@ "@aws-sdk/util-dynamodb": "3.996.5", "@boxyhq/error-code-mnemonic": "0.1.1", "@boxyhq/metrics": "0.2.15", - "@boxyhq/saml20": "1.16.0", + "@boxyhq/saml20": "3.2.1", "@googleapis/admin": "31.0.0", "axios": "1.18.1", "better-sqlite3": "12.11.1", @@ -758,16 +758,19 @@ } }, "node_modules/@boxyhq/saml20": { - "version": "1.16.0", - "resolved": "https://registry.npmjs.org/@boxyhq/saml20/-/saml20-1.16.0.tgz", - "integrity": "sha512-uSdGrZTv8O9bhcYDg6iwUXVGbBlbL1jTatdwhTowZu6jUInIwrq7txIvuDxH3j/iFD8d70xVc6zSAxP4T9XeOw==", + "version": "3.2.1", + "resolved": "https://registry.npmjs.org/@boxyhq/saml20/-/saml20-3.2.1.tgz", + "integrity": "sha512-UkJNlzYnl8kK9DAG66ie4pAZlt/WW/TyqSfbx3dzNb1974NkIjQXsvwPET+cQ1PSH7zH7GNMIKEpOgIGDWg73Q==", "license": "MIT", "dependencies": { - "@xmldom/xmldom": "0.9.10", - "xml-crypto": "6.1.2", - "xml-encryption": "4.0.1", - "xml2js": "0.6.2", - "xmlbuilder": "15.1.1" + "@xmldom/xmldom": "0.9.12", + "xml-crypto": "6.4.0", + "xml-encryption": "6.0.2", + "xmlbuilder2": "4.0.3", + "xpath": "0.0.36" + }, + "engines": { + "node": ">=22.12.0" } }, "node_modules/@colors/colors": { @@ -1220,6 +1223,54 @@ "node": "^20.17.0 || >=22.9.0" } }, + "node_modules/@oozcitak/dom": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/@oozcitak/dom/-/dom-2.0.2.tgz", + "integrity": "sha512-GjpKhkSYC3Mj4+lfwEyI1dqnsKTgwGy48ytZEhm4A/xnH/8z9M3ZVXKr/YGQi3uCLs1AEBS+x5T2JPiueEDW8w==", + "license": "MIT", + "dependencies": { + "@oozcitak/infra": "^2.0.2", + "@oozcitak/url": "^3.0.0", + "@oozcitak/util": "^10.0.0" + }, + "engines": { + "node": ">=20.0" + } + }, + "node_modules/@oozcitak/infra": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/@oozcitak/infra/-/infra-2.0.2.tgz", + "integrity": "sha512-2g+E7hoE2dgCz/APPOEK5s3rMhJvNxSMBrP+U+j1OWsIbtSpWxxlUjq1lU8RIsFJNYv7NMlnVsCuHcUzJW+8vA==", + "license": "MIT", + "dependencies": { + "@oozcitak/util": "^10.0.0" + }, + "engines": { + "node": ">=20.0" + } + }, + "node_modules/@oozcitak/url": { + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/@oozcitak/url/-/url-3.0.0.tgz", + "integrity": "sha512-ZKfET8Ak1wsLAiLWNfFkZc/BraDccuTJKR6svTYc7sVjbR+Iu0vtXdiDMY4o6jaFl5TW2TlS7jbLl4VovtAJWQ==", + "license": "MIT", + "dependencies": { + "@oozcitak/infra": "^2.0.2", + "@oozcitak/util": "^10.0.0" + }, + "engines": { + "node": ">=20.0" + } + }, + "node_modules/@oozcitak/util": { + "version": "10.0.0", + "resolved": "https://registry.npmjs.org/@oozcitak/util/-/util-10.0.0.tgz", + "integrity": "sha512-hAX0pT/73190NLqBPPWSdBVGtbY6VOhWYK3qqHqtXQ1gK7kS2yz4+ivsN07hpJ6I3aeMtKP6J6npsEKOAzuTLA==", + "license": "MIT", + "engines": { + "node": ">=20.0" + } + }, "node_modules/@open-draft/deferred-promise": { "version": "2.2.0", "resolved": "https://registry.npmjs.org/@open-draft/deferred-promise/-/deferred-promise-2.2.0.tgz", @@ -2107,9 +2158,9 @@ } }, "node_modules/@xmldom/xmldom": { - "version": "0.9.10", - "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.9.10.tgz", - "integrity": "sha512-A9gOqLdi6cV4ibazAjcQufGj0B1y/vDqYrcuP6d/6x8P27gRS8643Dj9o1dEKtB6O7fwxb2FgBmJS2mX7gpvdw==", + "version": "0.9.12", + "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.9.12.tgz", + "integrity": "sha512-5AXjrcMClTryPe9LgZrygpB1lj7s0S9E0+W+AHaVKAVyHanafK86iPSvG5xHVSp/jC+VH1UXu0TAEmY279xH7A==", "license": "MIT", "engines": { "node": ">=14.6" @@ -2234,6 +2285,12 @@ "devOptional": true, "license": "MIT" }, + "node_modules/argparse": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz", + "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==", + "license": "Python-2.0" + }, "node_modules/async-hook-domain": { "version": "4.0.1", "resolved": "https://registry.npmjs.org/async-hook-domain/-/async-hook-domain-4.0.1.tgz", @@ -4301,6 +4358,28 @@ "dev": true, "license": "MIT" }, + "node_modules/js-yaml": { + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "MIT", + "dependencies": { + "argparse": "^2.0.1" + }, + "bin": { + "js-yaml": "bin/js-yaml.js" + } + }, "node_modules/json-bigint": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/json-bigint/-/json-bigint-1.0.0.tgz", @@ -6254,15 +6333,6 @@ "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==", "license": "MIT" }, - "node_modules/sax": { - "version": "1.5.0", - "resolved": "https://registry.npmjs.org/sax/-/sax-1.5.0.tgz", - "integrity": "sha512-21IYA3Q5cQf089Z6tgaUTr7lDAyzoTPx5HRtbhsME8Udispad8dC/+sziTNugOEx54ilvatQ9YCzl4KQLPcRHA==", - "license": "BlueOak-1.0.0", - "engines": { - "node": ">=11.0.0" - } - }, "node_modules/scheduler": { "version": "0.23.2", "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.23.2.tgz", @@ -8441,13 +8511,13 @@ } }, "node_modules/xml-crypto": { - "version": "6.1.2", - "resolved": "https://registry.npmjs.org/xml-crypto/-/xml-crypto-6.1.2.tgz", - "integrity": "sha512-leBOVQdVi8FvPJrMYoum7Ici9qyxfE4kVi+AkpUoYCSXaQF4IlBm1cneTK9oAxR61LpYxTx7lNcsnBIeRpGW2w==", + "version": "6.4.0", + "resolved": "https://registry.npmjs.org/xml-crypto/-/xml-crypto-6.4.0.tgz", + "integrity": "sha512-d21ModhBO/+QWWAmOjyDeQJuHNmsR/HtOxyBchiTbKfGNKuHYwQNd+SlLhwyyrwoAGLp4Qc6BQ7nAtnM47dHSQ==", "license": "MIT", "dependencies": { "@xmldom/is-dom-node": "^1.0.1", - "@xmldom/xmldom": "^0.8.10", + "@xmldom/xmldom": "^0.8.15", "xpath": "^0.0.33" }, "engines": { @@ -8455,78 +8525,61 @@ } }, "node_modules/xml-crypto/node_modules/@xmldom/xmldom": { - "version": "0.8.13", - "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.13.tgz", - "integrity": "sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw==", + "version": "0.8.15", + "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.15.tgz", + "integrity": "sha512-/5NV/vDALVFDXgLmfsy9TRCBlKwO2LNBFzpzvb9iIj+jR+eSc6DLYYvVOdivT/jm7MtU6TebYuRmzEOI7w40UA==", "license": "MIT", "engines": { "node": ">=10.0.0" } }, + "node_modules/xml-crypto/node_modules/xpath": { + "version": "0.0.33", + "resolved": "https://registry.npmjs.org/xpath/-/xpath-0.0.33.tgz", + "integrity": "sha512-NNXnzrkDrAzalLhIUc01jO2mOzXGXh1JwPgkihcLLzw98c0WgYDmmjSh1Kl3wzaxSVWMuA+fe0WTWOBDWCBmNA==", + "license": "MIT", + "engines": { + "node": ">=0.6.0" + } + }, "node_modules/xml-encryption": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/xml-encryption/-/xml-encryption-4.0.1.tgz", - "integrity": "sha512-ENtwvonaBs59ssASLh4HpfBAYfBBvl9+HudkfE71z9pTiNmXtyuyr50qmCW7o8/3xVh/aNosYYRjdZdm+fO09g==", + "version": "6.0.2", + "resolved": "https://registry.npmjs.org/xml-encryption/-/xml-encryption-6.0.2.tgz", + "integrity": "sha512-pKkAoJswMndC+ErrweY84tdaR0xTdnr5IWb65ri7lKavGvErzOArffFlOcTVin7dzMiUFhSvWvcNAtFkNxnk2g==", "license": "MIT", "dependencies": { "@xmldom/xmldom": "^0.8.13", - "escape-html": "^1.0.3", - "xpath": "0.0.32" + "escape-html": "^1.0.3" } }, "node_modules/xml-encryption/node_modules/@xmldom/xmldom": { - "version": "0.8.13", - "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.13.tgz", - "integrity": "sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw==", + "version": "0.8.15", + "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.15.tgz", + "integrity": "sha512-/5NV/vDALVFDXgLmfsy9TRCBlKwO2LNBFzpzvb9iIj+jR+eSc6DLYYvVOdivT/jm7MtU6TebYuRmzEOI7w40UA==", "license": "MIT", "engines": { "node": ">=10.0.0" } }, - "node_modules/xml-encryption/node_modules/xpath": { - "version": "0.0.32", - "resolved": "https://registry.npmjs.org/xpath/-/xpath-0.0.32.tgz", - "integrity": "sha512-rxMJhSIoiO8vXcWvSifKqhvV96GjiD5wYb8/QHdoRyQvraTpp4IEv944nhGausZZ3u7dhQXteZuZbaqfpB7uYw==", - "license": "MIT", - "engines": { - "node": ">=0.6.0" - } - }, - "node_modules/xml2js": { - "version": "0.6.2", - "resolved": "https://registry.npmjs.org/xml2js/-/xml2js-0.6.2.tgz", - "integrity": "sha512-T4rieHaC1EXcES0Kxxj4JWgaUQHDk+qwHcYOCFHfiwKz7tOVPLq7Hjq9dM1WCMhylqMEfP7hMcOIChvotiZegA==", + "node_modules/xmlbuilder2": { + "version": "4.0.3", + "resolved": "https://registry.npmjs.org/xmlbuilder2/-/xmlbuilder2-4.0.3.tgz", + "integrity": "sha512-bx8Q1STctnNaaDymWnkfQLKofs0mGNN7rLLapJlGuV3VlvegD7Ls4ggMjE3aUSWItCCzU0PEv45lI87iSigiCA==", "license": "MIT", "dependencies": { - "sax": ">=0.6.0", - "xmlbuilder": "~11.0.0" + "@oozcitak/dom": "^2.0.2", + "@oozcitak/infra": "^2.0.2", + "@oozcitak/util": "^10.0.0", + "js-yaml": "^4.1.1" }, "engines": { - "node": ">=4.0.0" - } - }, - "node_modules/xml2js/node_modules/xmlbuilder": { - "version": "11.0.1", - "resolved": "https://registry.npmjs.org/xmlbuilder/-/xmlbuilder-11.0.1.tgz", - "integrity": "sha512-fDlsI/kFEx7gLvbecc0/ohLG50fugQp8ryHzMTuW9vSa1GJ0XYWKnhsUx7oie3G98+r56aTQIUB4kht42R3JvA==", - "license": "MIT", - "engines": { - "node": ">=4.0" - } - }, - "node_modules/xmlbuilder": { - "version": "15.1.1", - "resolved": "https://registry.npmjs.org/xmlbuilder/-/xmlbuilder-15.1.1.tgz", - "integrity": "sha512-yMqGBqtXyeN1e3TGYvgNgDVZ3j84W4cwkOXQswghol6APgZWaff9lnbvN7MHYJOiXsvGPXtjTYJEiC9J2wv9Eg==", - "license": "MIT", - "engines": { - "node": ">=8.0" + "node": ">=20.0" } }, "node_modules/xpath": { - "version": "0.0.33", - "resolved": "https://registry.npmjs.org/xpath/-/xpath-0.0.33.tgz", - "integrity": "sha512-NNXnzrkDrAzalLhIUc01jO2mOzXGXh1JwPgkihcLLzw98c0WgYDmmjSh1Kl3wzaxSVWMuA+fe0WTWOBDWCBmNA==", + "version": "0.0.36", + "resolved": "https://registry.npmjs.org/xpath/-/xpath-0.0.36.tgz", + "integrity": "sha512-HuqAnJx5YJoDeLub7hhcNoiRvnqqrgoSsI4kLrOtv6XkaUI0zY9ylL4+ULozB35JT1SVMfdexsMqRbTp7bkFGQ==", "license": "MIT", "engines": { "node": ">=0.6.0" diff --git a/npm/package.json b/npm/package.json index 8e9685ef8..cd661608e 100644 --- a/npm/package.json +++ b/npm/package.json @@ -48,7 +48,7 @@ "@aws-sdk/util-dynamodb": "3.996.5", "@boxyhq/error-code-mnemonic": "0.1.1", "@boxyhq/metrics": "0.2.15", - "@boxyhq/saml20": "1.16.0", + "@boxyhq/saml20": "3.2.1", "@googleapis/admin": "31.0.0", "axios": "1.18.1", "encoding": "0.1.13", diff --git a/npm/src/controller/logout.ts b/npm/src/controller/logout.ts index c1b21e889..8a4eb31df 100644 --- a/npm/src/controller/logout.ts +++ b/npm/src/controller/logout.ts @@ -143,7 +143,12 @@ export class LogoutController { const { idpMetadata, defaultRedirectUrl }: SAMLConnection = samlConnections[0]; - if (!(await saml.validateSignature(rawResponse, null, idpMetadata.thumbprint))) { + // validateSignature throws when the signature does not verify (saml20 >= 2.0). + try { + if (!(await saml.validateSignature(rawResponse, null, idpMetadata.thumbprint))) { + throw new Error('Invalid signature.'); + } + } catch (_err) { throw new JacksonError('Invalid signature.', 403); } diff --git a/npm/src/controller/oauth.ts b/npm/src/controller/oauth.ts index 08768d98d..397212455 100644 --- a/npm/src/controller/oauth.ts +++ b/npm/src/controller/oauth.ts @@ -3,7 +3,7 @@ import { promisify } from 'util'; import { deflateRaw } from 'zlib'; import saml from '@boxyhq/saml20'; import { validateSSOURL, sigAlg, signQueryString } from './utils'; -import { SAMLProfile } from '@boxyhq/saml20/dist/typings'; +import type { SAMLProfile } from '@boxyhq/saml20'; import type { IOAuthController, OAuthReq, diff --git a/npm/src/controller/sso-handler.ts b/npm/src/controller/sso-handler.ts index 34db6ae1b..dd34b4a72 100644 --- a/npm/src/controller/sso-handler.ts +++ b/npm/src/controller/sso-handler.ts @@ -2,7 +2,7 @@ import saml from '@boxyhq/saml20'; import crypto from 'crypto'; import { promisify } from 'util'; import { deflateRaw } from 'zlib'; -import type { SAMLProfile } from '@boxyhq/saml20/dist/typings'; +import type { SAMLProfile } from '@boxyhq/saml20'; import type { Storable, diff --git a/npm/src/controller/utils.ts b/npm/src/controller/utils.ts index ef1d65a67..a07d49ef9 100644 --- a/npm/src/controller/utils.ts +++ b/npm/src/controller/utils.ts @@ -78,7 +78,7 @@ export const OAuthErrorResponse = ({ // https://kentcdodds.com/blog/get-a-catch-block-error-message-with-typescript export function getErrorMessage(error: unknown) { if (error instanceof saml.WrapError) { - return error.message + ' ' + error.inner.message; + return error.inner ? error.message + ' ' + error.inner.message : error.message; } if (error instanceof Error) { if (error instanceof JacksonError) { diff --git a/npm/src/ee/identity-federation/sso.ts b/npm/src/ee/identity-federation/sso.ts index 8c5269ff6..fe6c26573 100644 --- a/npm/src/ee/identity-federation/sso.ts +++ b/npm/src/ee/identity-federation/sso.ts @@ -81,8 +81,17 @@ export class SSO { context.providerName = providerName; // Verify the request if it is signed - if (publicKey && !saml.validateSignature(decodedRequest, publicKey, null)) { - throw new JacksonError(GENERIC_ERR_STRING, 400, 'Invalid SAML Request signature.'); + if (publicKey) { + // validateSignature throws when the signature does not verify (saml20 >= 2.0). + let signed: string | null = null; + try { + signed = saml.validateSignature(decodedRequest, publicKey, null); + } catch (_err) { + signed = null; + } + if (!signed) { + throw new JacksonError(GENERIC_ERR_STRING, 400, 'Invalid SAML Request signature.'); + } } app = await this.app.getByEntityId(entityId); diff --git a/npm/src/sso-traces/types.ts b/npm/src/sso-traces/types.ts index 94451c2d4..c0369dbd4 100644 --- a/npm/src/sso-traces/types.ts +++ b/npm/src/sso-traces/types.ts @@ -1,4 +1,4 @@ -import { SAMLProfile } from '@boxyhq/saml20/dist/typings'; +import type { SAMLProfile } from '@boxyhq/saml20'; import SSOTraces from '.'; import { OIDCIdPInitiatedReq } from '../typings'; diff --git a/npm/test/sso/logout.test.ts b/npm/test/sso/logout.test.ts index 25ce6b871..a0f1da03a 100644 --- a/npm/test/sso/logout.test.ts +++ b/npm/test/sso/logout.test.ts @@ -189,6 +189,22 @@ tap.test('LogoutController -> createRequest', async (t) => { } }); + t.test('Should throw an error when the signature does not verify', async (t) => { + // Destination is covered by the signature, so changing it breaks the signature + // without tripping the status or request ID checks that run first. + const tampered = Buffer.from( + logoutResponseXML.replace('Destination="http://localhost:3000/slo"', 'Destination="http://localhost:3000/evil"') + ).toString('base64'); + + await t.rejects( + logoutController.handleResponse({ + SAMLResponse: tampered, + RelayState: relayState, + }), + { message: 'Invalid signature.', statusCode: 403 } + ); + }); + t.test('Return the redirectUrl after the post logout', async (t) => { const result = await logoutController.handleResponse({ SAMLResponse: logoutResponse, diff --git a/npm/test/sso/saml_idp_api.test.ts b/npm/test/sso/saml_idp_api.test.ts index a2f2469b5..a0d994037 100644 --- a/npm/test/sso/saml_idp_api.test.ts +++ b/npm/test/sso/saml_idp_api.test.ts @@ -168,7 +168,7 @@ tap.test('controller/api', async (t) => { await connectionAPIController.createSAMLConnection(body as SAMLSSOConnectionWithEncodedMetadata); t.fail('Expecting Error.'); } catch (err: any) { - t.match(err.message, /Non-whitespace before first tag./); + t.match(err.message, /missing root element/); } }); }); diff --git a/package-lock.json b/package-lock.json index 1d1513f12..a715d0b8b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1294,16 +1294,19 @@ "link": true }, "node_modules/@boxyhq/saml20": { - "version": "1.16.0", - "resolved": "https://registry.npmjs.org/@boxyhq/saml20/-/saml20-1.16.0.tgz", - "integrity": "sha512-uSdGrZTv8O9bhcYDg6iwUXVGbBlbL1jTatdwhTowZu6jUInIwrq7txIvuDxH3j/iFD8d70xVc6zSAxP4T9XeOw==", + "version": "3.2.1", + "resolved": "https://registry.npmjs.org/@boxyhq/saml20/-/saml20-3.2.1.tgz", + "integrity": "sha512-UkJNlzYnl8kK9DAG66ie4pAZlt/WW/TyqSfbx3dzNb1974NkIjQXsvwPET+cQ1PSH7zH7GNMIKEpOgIGDWg73Q==", "license": "MIT", "dependencies": { - "@xmldom/xmldom": "0.9.10", - "xml-crypto": "6.1.2", - "xml-encryption": "4.0.1", - "xml2js": "0.6.2", - "xmlbuilder": "15.1.1" + "@xmldom/xmldom": "0.9.12", + "xml-crypto": "6.4.0", + "xml-encryption": "6.0.2", + "xmlbuilder2": "4.0.3", + "xpath": "0.0.36" + }, + "engines": { + "node": ">=22.12.0" } }, "node_modules/@colors/colors": { @@ -2872,6 +2875,54 @@ "@octokit/openapi-types": "^27.0.0" } }, + "node_modules/@oozcitak/dom": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/@oozcitak/dom/-/dom-2.0.2.tgz", + "integrity": "sha512-GjpKhkSYC3Mj4+lfwEyI1dqnsKTgwGy48ytZEhm4A/xnH/8z9M3ZVXKr/YGQi3uCLs1AEBS+x5T2JPiueEDW8w==", + "license": "MIT", + "dependencies": { + "@oozcitak/infra": "^2.0.2", + "@oozcitak/url": "^3.0.0", + "@oozcitak/util": "^10.0.0" + }, + "engines": { + "node": ">=20.0" + } + }, + "node_modules/@oozcitak/infra": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/@oozcitak/infra/-/infra-2.0.2.tgz", + "integrity": "sha512-2g+E7hoE2dgCz/APPOEK5s3rMhJvNxSMBrP+U+j1OWsIbtSpWxxlUjq1lU8RIsFJNYv7NMlnVsCuHcUzJW+8vA==", + "license": "MIT", + "dependencies": { + "@oozcitak/util": "^10.0.0" + }, + "engines": { + "node": ">=20.0" + } + }, + "node_modules/@oozcitak/url": { + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/@oozcitak/url/-/url-3.0.0.tgz", + "integrity": "sha512-ZKfET8Ak1wsLAiLWNfFkZc/BraDccuTJKR6svTYc7sVjbR+Iu0vtXdiDMY4o6jaFl5TW2TlS7jbLl4VovtAJWQ==", + "license": "MIT", + "dependencies": { + "@oozcitak/infra": "^2.0.2", + "@oozcitak/util": "^10.0.0" + }, + "engines": { + "node": ">=20.0" + } + }, + "node_modules/@oozcitak/util": { + "version": "10.0.0", + "resolved": "https://registry.npmjs.org/@oozcitak/util/-/util-10.0.0.tgz", + "integrity": "sha512-hAX0pT/73190NLqBPPWSdBVGtbY6VOhWYK3qqHqtXQ1gK7kS2yz4+ivsN07hpJ6I3aeMtKP6J6npsEKOAzuTLA==", + "license": "MIT", + "engines": { + "node": ">=20.0" + } + }, "node_modules/@open-draft/deferred-promise": { "version": "2.2.0", "dev": true, @@ -6027,15 +6078,17 @@ }, "node_modules/@xmldom/is-dom-node": { "version": "1.0.1", + "resolved": "https://registry.npmjs.org/@xmldom/is-dom-node/-/is-dom-node-1.0.1.tgz", + "integrity": "sha512-CJDxIgE5I0FH+ttq/Fxy6nRpxP70+e2O048EPe85J2use3XKdatVM7dDVvFNjQudd9B49NPoZ+8PG49zj4Er8Q==", "license": "MIT", "engines": { "node": ">= 16" } }, "node_modules/@xmldom/xmldom": { - "version": "0.9.10", - "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.9.10.tgz", - "integrity": "sha512-A9gOqLdi6cV4ibazAjcQufGj0B1y/vDqYrcuP6d/6x8P27gRS8643Dj9o1dEKtB6O7fwxb2FgBmJS2mX7gpvdw==", + "version": "0.9.12", + "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.9.12.tgz", + "integrity": "sha512-5AXjrcMClTryPe9LgZrygpB1lj7s0S9E0+W+AHaVKAVyHanafK86iPSvG5xHVSp/jC+VH1UXu0TAEmY279xH7A==", "license": "MIT", "engines": { "node": ">=14.6" @@ -6192,7 +6245,6 @@ }, "node_modules/argparse": { "version": "2.0.1", - "dev": true, "license": "Python-2.0" }, "node_modules/aria-query": { @@ -11138,7 +11190,6 @@ "version": "4.3.0", "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", - "dev": true, "funding": [ { "type": "github", @@ -16024,13 +16075,6 @@ "version": "2.1.2", "license": "MIT" }, - "node_modules/sax": { - "version": "1.5.0", - "license": "BlueOak-1.0.0", - "engines": { - "node": ">=11.0.0" - } - }, "node_modules/scheduler": { "version": "0.23.2", "license": "MIT", @@ -19815,11 +19859,13 @@ } }, "node_modules/xml-crypto": { - "version": "6.1.2", + "version": "6.4.0", + "resolved": "https://registry.npmjs.org/xml-crypto/-/xml-crypto-6.4.0.tgz", + "integrity": "sha512-d21ModhBO/+QWWAmOjyDeQJuHNmsR/HtOxyBchiTbKfGNKuHYwQNd+SlLhwyyrwoAGLp4Qc6BQ7nAtnM47dHSQ==", "license": "MIT", "dependencies": { "@xmldom/is-dom-node": "^1.0.1", - "@xmldom/xmldom": "^0.8.10", + "@xmldom/xmldom": "^0.8.15", "xpath": "^0.0.33" }, "engines": { @@ -19827,70 +19873,61 @@ } }, "node_modules/xml-crypto/node_modules/@xmldom/xmldom": { - "version": "0.8.13", - "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.13.tgz", - "integrity": "sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw==", + "version": "0.8.15", + "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.15.tgz", + "integrity": "sha512-/5NV/vDALVFDXgLmfsy9TRCBlKwO2LNBFzpzvb9iIj+jR+eSc6DLYYvVOdivT/jm7MtU6TebYuRmzEOI7w40UA==", "license": "MIT", "engines": { "node": ">=10.0.0" } }, + "node_modules/xml-crypto/node_modules/xpath": { + "version": "0.0.33", + "resolved": "https://registry.npmjs.org/xpath/-/xpath-0.0.33.tgz", + "integrity": "sha512-NNXnzrkDrAzalLhIUc01jO2mOzXGXh1JwPgkihcLLzw98c0WgYDmmjSh1Kl3wzaxSVWMuA+fe0WTWOBDWCBmNA==", + "license": "MIT", + "engines": { + "node": ">=0.6.0" + } + }, "node_modules/xml-encryption": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/xml-encryption/-/xml-encryption-4.0.1.tgz", - "integrity": "sha512-ENtwvonaBs59ssASLh4HpfBAYfBBvl9+HudkfE71z9pTiNmXtyuyr50qmCW7o8/3xVh/aNosYYRjdZdm+fO09g==", + "version": "6.0.2", + "resolved": "https://registry.npmjs.org/xml-encryption/-/xml-encryption-6.0.2.tgz", + "integrity": "sha512-pKkAoJswMndC+ErrweY84tdaR0xTdnr5IWb65ri7lKavGvErzOArffFlOcTVin7dzMiUFhSvWvcNAtFkNxnk2g==", "license": "MIT", "dependencies": { "@xmldom/xmldom": "^0.8.13", - "escape-html": "^1.0.3", - "xpath": "0.0.32" + "escape-html": "^1.0.3" } }, "node_modules/xml-encryption/node_modules/@xmldom/xmldom": { - "version": "0.8.13", - "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.13.tgz", - "integrity": "sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw==", + "version": "0.8.15", + "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.15.tgz", + "integrity": "sha512-/5NV/vDALVFDXgLmfsy9TRCBlKwO2LNBFzpzvb9iIj+jR+eSc6DLYYvVOdivT/jm7MtU6TebYuRmzEOI7w40UA==", "license": "MIT", "engines": { "node": ">=10.0.0" } }, - "node_modules/xml-encryption/node_modules/xpath": { - "version": "0.0.32", - "resolved": "https://registry.npmjs.org/xpath/-/xpath-0.0.32.tgz", - "integrity": "sha512-rxMJhSIoiO8vXcWvSifKqhvV96GjiD5wYb8/QHdoRyQvraTpp4IEv944nhGausZZ3u7dhQXteZuZbaqfpB7uYw==", - "license": "MIT", - "engines": { - "node": ">=0.6.0" - } - }, - "node_modules/xml2js": { - "version": "0.6.2", + "node_modules/xmlbuilder2": { + "version": "4.0.3", + "resolved": "https://registry.npmjs.org/xmlbuilder2/-/xmlbuilder2-4.0.3.tgz", + "integrity": "sha512-bx8Q1STctnNaaDymWnkfQLKofs0mGNN7rLLapJlGuV3VlvegD7Ls4ggMjE3aUSWItCCzU0PEv45lI87iSigiCA==", "license": "MIT", "dependencies": { - "sax": ">=0.6.0", - "xmlbuilder": "~11.0.0" + "@oozcitak/dom": "^2.0.2", + "@oozcitak/infra": "^2.0.2", + "@oozcitak/util": "^10.0.0", + "js-yaml": "^4.1.1" }, "engines": { - "node": ">=4.0.0" - } - }, - "node_modules/xml2js/node_modules/xmlbuilder": { - "version": "11.0.1", - "license": "MIT", - "engines": { - "node": ">=4.0" - } - }, - "node_modules/xmlbuilder": { - "version": "15.1.1", - "license": "MIT", - "engines": { - "node": ">=8.0" + "node": ">=20.0" } }, "node_modules/xpath": { - "version": "0.0.33", + "version": "0.0.36", + "resolved": "https://registry.npmjs.org/xpath/-/xpath-0.0.36.tgz", + "integrity": "sha512-HuqAnJx5YJoDeLub7hhcNoiRvnqqrgoSsI4kLrOtv6XkaUI0zY9ylL4+ULozB35JT1SVMfdexsMqRbTp7bkFGQ==", "license": "MIT", "engines": { "node": ">=0.6.0" @@ -20059,7 +20096,7 @@ "@aws-sdk/util-dynamodb": "3.996.5", "@boxyhq/error-code-mnemonic": "0.1.1", "@boxyhq/metrics": "0.2.15", - "@boxyhq/saml20": "1.16.0", + "@boxyhq/saml20": "3.2.1", "@googleapis/admin": "31.0.0", "axios": "1.18.1", "better-sqlite3": "12.11.1",