Node-forge vulnerabilities

[pawelzygmuntowski]

The node-forge version used in node-xml-encryption that saml2 uses has some vulnerabilities.

https://deps.dev/advisory/GHSA/GHSA-5rrq-pxf6-6jx5 - Prototype Pollution in node-forge debug API.
and also
https://deps.dev/advisory/GHSA/GHSA-gf8q-jrpm-jvxq - URL parsing in node-forge could lead to undesired behavior.

This was fixed in the newest version of node-xml-encryption:
auth0/node-xml-encryption#94

So upgrading node-xml-encryption to the latest release should fix this.

Can we expect this to be fixed any time soon?

[slowtick]

Would be interested in fix for this. The newer version of xml-encryption (2.0.0) seems to be api compatible. With nodejs 16.x added a dependency override in my package.json as in below and it worked with current release of saml2-js.

"overrides": {
    "saml2-js": {
      "xmldom": "^0.6.0",
      "xml-encryption": "^2.0.0"
    }
  }

[darioackermann]

I am mainting a fork of this repo with all dependency updates applied. Feel free to use it in any case.

[mcab]

Addressed in #261.