Validate SAML responses

SSO-Auth/Api/SSOController.cs

@@ -578,6 +578,11 @@ public class SSOController : ControllerBase
         {
             var samlResponse = new Response(config.SamlCertificate, Request.Form["SAMLResponse"]);
 
+            if (!samlResponse.IsValid())
+            {
+                return Problem("Invalid SAML signature");
+            }
+
             bool valid = false;
 
             // If no roles are configured, don't use RBAC
@@ -736,6 +741,12 @@ public class SSOController : ControllerBase
             bool liveTv = config.EnableLiveTv;
             bool liveTvManagement = config.EnableLiveTvManagement;
             var samlResponse = new Response(config.SamlCertificate, response.Data);
+
+            if (!samlResponse.IsValid())
+            {
+                return Problem("Invalid SAML signature");
+            }
+
             List<string> folders;
             if (!config.EnableFolderRoles && config.EnabledFolders != null)
             {
@@ -1074,7 +1085,11 @@ public class SSOController : ControllerBase
         }
 
         var samlResponse = new Response(config.SamlCertificate, response.Data);
-        // TODO: Does saml response require further validation?
+
+        if (!samlResponse.IsValid())
+        {
+            return Problem("Invalid SAML signature");
+        }
 
         string providerUserId = samlResponse.GetNameID();
 

SSO-Auth/SSO-Auth.csproj

@@ -3,8 +3,8 @@
   <PropertyGroup>
     <TargetFramework>net9.0</TargetFramework>
     <RootNamespace>Jellyfin.Plugin.SSO_Auth</RootNamespace>
-    <AssemblyVersion>4.0.0.3</AssemblyVersion>
-    <FileVersion>4.0.0.3</FileVersion>
+    <AssemblyVersion>4.0.0.4</AssemblyVersion>
+    <FileVersion>4.0.0.4</FileVersion>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
     <TreatWarningsAsErrors>false</TreatWarningsAsErrors>
   </PropertyGroup>

build.yaml

@@ -1,7 +1,7 @@
 name: "SSO Authentication"
 guid: "505ce9d1-d916-42fa-86ca-673ef241d7df"
 imageUrl: "https://raw.githubusercontent.com/9p4/jellyfin-plugin-sso/main/img/logo.png"
-version: "4.0.0.3"
+version: "4.0.0.4"
 targetAbi: "10.11.0.0"
 framework: "net9.0"
 owner: "9p4"
@@ -15,6 +15,7 @@ artifacts:
   - "Duende.IdentityModel.OidcClient.dll"
   - "Duende.IdentityModel.dll"
 changelog: |
+  4.0.0.4: Fix security issue in SAML
   4.0.0.0: Jellyfin 10.11
   3.5.3.0: Allow for OID-provided avatars, various bugfixes and workarounds
   3.5.2.4: Updates for Jellyfin 10.9