Refine SLO RelayState validation

[gerardo-navarro]

This pull request introduces a new option for validating SAML Single Logout (SLO) RelayState parameters, improving the security and configurability of logout flows in the OmniAuth SAML strategy. The changes include the addition of a default validator, new configuration options, and comprehensive test coverage for various RelayState scenarios.

Addresses #240 (comment)

SLO RelayState validation enhancements

• Added a new :slo_relay_state_validator option to the OmniAuth SAML strategy, allowing custom validation of RelayState values during Single Logout flows. The default validator only accepts relative paths starting with / and rejects absolute URLs, protocol-relative URLs, and other potentially unsafe values. [1] [2]
• Implemented logic in slo_relay_state and related methods to use the validator for checking if a provided RelayState is acceptable, falling back to a default value if not.

Test suite improvements

• Added extensive RSpec tests to cover different RelayState validation scenarios, including default, custom, and edge cases, for both logout requests and responses. These tests ensure that only valid RelayState values are used for redirects, and that unsafe or invalid values are rejected or replaced. [1] [2] [3]
• Refactored test helpers and specs for clarity and to support the new validation logic.

Documentation updates

• Updated the README.md to document the new :slo_relay_state_validator option, its default behavior, and usage examples, helping developers understand how to customize RelayState validation.

Dependency update

• Required the Ruby standard library uri in saml.rb to support robust URI parsing for RelayState validation.

Testing

bundle exec rspec

[gerardo-navarro]

@fh1ch @bufferoverflow Hi 👋 Can you please have a look at this PR.

[Copilot]

Pull Request Overview

This PR enhances security for SAML Single Logout (SLO) by introducing a configurable RelayState validator. The default validator restricts RelayState values to relative paths starting with /, preventing open redirect vulnerabilities from absolute URLs, protocol-relative URLs, and other potentially unsafe values.

• Adds :slo_relay_state_validator option with a secure default that validates RelayState parameters
• Refactors RelayState handling logic to use the validator before accepting user-provided values
• Provides comprehensive test coverage for various RelayState validation scenarios

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
lib/omniauth/strategies/saml.rb	Implements the default RelayState validator and refactors slo_relay_state method to validate input before use
spec/omniauth/strategies/saml_spec.rb	Adds extensive test coverage for RelayState validation scenarios including edge cases and custom validators
README.md	Documents the new :slo_relay_state_validator option with usage examples

Comments suppressed due to low confidence (1)

lib/omniauth/strategies/saml.rb:187

• This assignment to arity is useless, since its value is never read.

        arity = validator.arity

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[gerardo-navarro]

I rebased with the latest master branch and resolved the remark from copilot.

@fh1ch Let me know if you have other concerns that I should address.

[Copilot]

Pull Request Overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[fh1ch]

@gerardo-navarro thanks a lot for the rework here, all good now from my end as well 💚

LGTM 👍