xmldom

.travis.yml

@@ -0,0 +1,11 @@
+language: node_js
+
+node_js:
+  - node
+  - 'lts/*'
+
+before_script:
+  - npm install
+
+script:
+  - npm test && npm audit --production

README.md

@@ -1,11 +1,11 @@
-SAML 2.0 & 1.1 Assertion Parser & Validator
+SAML 2.0 & 1.1 Assertion Parser & Validator [![Build Status](https://travis-ci.com/phylp/saml20-maintained.svg?branch=master)](https://travis-ci.com/phylp/saml20-maintained)
 =============
-saml20 is a simple module that allows you to parse and validate SAML 2.0 and 1.1 tokens. It has been tested with [Microsoft ADFS](http://en.wikipedia.org/wiki/Active_Directory_Federation_Services), OKTA, and PingOne tokens.
+saml20-maintained is a fork of saml20. It is the same library with updated versions of vulnerable dependencies. 
 
 ## Installation
 
 ```bash
-$ npm install saml20
+$ npm install saml20-maintained
 ```
 
 ## Usage
@@ -18,7 +18,7 @@ Parses the `rawAssertion` without validating signature, expiration and audience.
 
 ```javascript
 
-var saml = require('saml20');
+var saml = require('saml20-maintained');
 
 saml.parse(rawAssertion, function(err, profile) {
 	// err
@@ -44,7 +44,7 @@ You can use either `thumbprint` or `publicKey` but you should use at least one.
 
 ```javascript
 
-var saml = require('saml20');
+var saml = require('saml20-maintained');
 
 var options = {
 	thumbprint: '1aeabdfa4473ecc7efc5947b18436c575574baf8',
@@ -64,7 +64,7 @@ or using publicKey:
 
 ```javascript
 
-var saml = require('saml20');
+var saml = require('saml20-maintained');
 
 var options = {
 	publicKey: 'MIICDzCCAXygAwIBAgIQVWXAvbbQyI5Bc...',

lib/validateSignature.js

@@ -2,11 +2,11 @@
 
 var select = require('xml-crypto').xpath;
 var SignedXml = require('xml-crypto').SignedXml;
-var dom = require('xmldom').DOMParser;
+var Dom = require('@xmldom/xmldom').DOMParser;
 var thumbprint = require('thumbprint');
 
 module.exports = function validateSignature(xml, cert, certThumbprint) {
-  var doc = new dom().parseFromString(xml);
+  var doc = new Dom().parseFromString(xml);
   var signature = select(doc, '/*/*/*[local-name(.)=\'Signature\' and namespace-uri(.)=\'http://www.w3.org/2000/09/xmldsig#\']')[0]
     || select(doc, '/*/*[local-name(.)=\'Signature\' and namespace-uri(.)=\'http://www.w3.org/2000/09/xmldsig#\']')[0];
   var signed = new SignedXml(null, {