Fix

simplesamlphp · Dec 13, 2019 · 72f562a · 72f562a
1 parent 8496630
commit 72f562a
Showing 1 changed file with 34 additions and 12 deletions.
diff --git a/src/SAML2/Assertion.php b/src/SAML2/Assertion.php
@@ -12,6 +12,7 @@
 use SAML2\Exception\RuntimeException;
 use SAML2\Utilities\Temporal;
 use SAML2\XML\Chunk;
+use SAML2\XML\saml\AttributeValue;
 use SAML2\XML\saml\Issuer;
 use SAML2\XML\saml\NameID;
 use SAML2\XML\saml\SubjectConfirmation;
@@ -566,14 +567,7 @@ private function parseAttributes(DOMElement $xml): void
      */
     private function parseAttributeValue(DOMNode $attribute, string $attributeName): void
     {
-        $this->attributes[$attributeName] = new XML\saml\Attribute($attribute);
-
-        if (!array_key_exists($attributeName, $this->attributesValueTypes)) {
-            $this->attributesValueTypes[$attributeName] = [];
-        }
-        $this->attributeNameFormats[$attributeName] = $attribute->getAttribute('NameFormat');
-        $this->attributeFriendlyNames[$attributeName] = $attribute->getAttribute('FriendlyName');
-
+        /** @var \DOMElement[] $values */
         $values = Utils::xpQuery($attribute, './saml_assertion:AttributeValue');
 
         if ($attributeName === Constants::EPTI_URN_MACE || $attributeName === Constants::EPTI_URN_OID) {
@@ -582,22 +576,50 @@ private function parseAttributeValue(DOMNode $attribute, string $attributeName):
                 $eptiNameId = Utils::xpQuery($eptiAttributeValue, './saml_assertion:NameID');
 
                 if (count($eptiNameId) === 1) {
-                    $this->attributes[$attributeName][] = new NameID($eptiNameId[0]);
+                    $nameId = new NameID($eptiNameId[0]);
+                    $this->attributes[$attributeName]->addAttributeValue(
+                        new AttributeValue($nameId->toXML()->textContent)
+                    );
                 } else {
                     /* Fall back for legacy IdPs sending string value (e.g. SSP < 1.15) */
                     Utils::getContainer()->getLogger()->warning(
                         sprintf("Attribute %s (EPTI) value %d is not an XML NameId", $attributeName, $index)
                     );
-                    $nameId = new NameID();
-                    $nameId->setValue($eptiAttributeValue->textContent);
-                    $this->attributes[$attributeName][] = $nameId;
+                    $this->attributes[$attributeName]->addAttributeValue(
+                        new AttributeValue($eptiAttributeValue->textContent)
+                    );
+                }
+            }
+
+            return;
+        }
+
+        foreach ($values as $value) {
+            $hasNonTextChildElements = false;
+            foreach ($value->childNodes as $childNode) {
+                /** @var \DOMNode $childNode */
+                if ($childNode->nodeType !== XML_TEXT_NODE) {
+                    $hasNonTextChildElements = true;
+                    break;
                 }
             }
+
             $type = $value->getAttribute('xsi:type');
             if ($type === '') {
                 $type = null;
             }
             $this->attributesValueTypes[$attributeName][] = $type;
+
+            if ($hasNonTextChildElements) {
+                $this->attributes[$attributeName]->addAttributeValue(
+                    new AttributeValue($value->childNodes)
+                );
+                continue;
+            }
+
+            $this->attributes[$attributeName]->addAttributeValue(
+                new AttributeValue(trim($value->textContent))
+            );
         }
     }