Define 'soft' variable to prevent exception when certificate inside document is invalid

Author: atyndall

lib/xml_security.rb

@@ -241,7 +241,7 @@ def validate_document(idp_cert_fingerprint, soft = true, options = {})
       validate_signature(base64_cert, soft)
     end
 
-    def validate_document_with_cert(idp_cert)
+    def validate_document_with_cert(idp_cert, soft = true)
       # get cert from response
       cert_element = REXML::XPath.first(
         self,

test/xml_security_test.rb

@@ -395,6 +395,19 @@ class XmlSecurityTest < Minitest::Test
     end
 
     describe '#validate_document_with_cert' do
+      describe 'with invalid document ' do
+        describe 'when certificate is invalid' do
+          let(:document_data) { read_response('response_with_signed_message_and_assertion.xml')
+            .sub(/<ds:X509Certificate>.*<\/ds:X509Certificate>/, "<ds:X509Certificate>invalid<\/ds:X509Certificate>") }
+          let(:document) { OneLogin::RubySaml::Response.new(document_data).document }
+          let(:idp_cert) { OpenSSL::X509::Certificate.new(ruby_saml_cert_text) }
+
+          it 'is invalid' do
+            refute document.validate_document_with_cert(idp_cert), 'Document should be invalid'
+          end
+        end
+      end
+
       describe 'with valid document ' do
         describe 'when response has cert' do
           let(:document_data) { read_response('response_with_signed_message_and_assertion.xml') }