Cherry pick branch 'genexuslabs:assertion_manipulation_attack' into beta

Author: sgrampone

gamsaml20/src/main/java/com/genexus/saml20/PostBinding.java

@@ -47,8 +47,7 @@ public boolean verifySignatures(SamlParms parms) {
 			return false;
 		}else {
 			this.verifiedDoc = SamlAssertionUtils.loadDocument(verified);
-			this.xmlDoc = null;
-			logger.debug(MessageFormat.format("verifySignatures sanitized xmlDoc {0}", Encoding.documentToString(this.xmlDoc)));
+			logger.debug(MessageFormat.format("verifySignatures - sanitized xmlDoc {0}", Encoding.documentToString(this.xmlDoc)));
 			return true;
 		}
 	}
@@ -74,7 +73,7 @@ public String getRoles(String name) {
 	}
 
 	public boolean isLogout(){
-		return SamlAssertionUtils.isLogout(this.verifiedDoc);
+		return SamlAssertionUtils.isLogout(this.xmlDoc);
 	}
 
 	// EXTERNAL OBJECT PUBLIC METHODS  - END

gamsaml20/src/main/java/com/genexus/saml20/utils/SamlAssertionUtils.java

@@ -51,6 +51,7 @@ public static Document loadDocument(String xml) {
 
 	public static String buildXmlLogin(List<org.w3c.dom.Element> assertions, Document xmlDoc){
 		//security meassure against assertion manipulation, it assures that every assertion to be used on the app has been signed and verified
+		logger.trace("buildXmlLogin");
 		org.w3c.dom.Element element = xmlDoc.getDocumentElement();
 		Node response  = element.cloneNode(false);
 
@@ -67,8 +68,10 @@ public static String buildXmlLogin(List<org.w3c.dom.Element> assertions, Documen
 	}
 
 	public static String buildXmlLogout(List<org.w3c.dom.Element> assertions){
+		logger.trace("buildXmlLogout");
 		if(assertions.isEmpty())
 		{
+			logger.error("buildXmlLogout - There are 0 signed assertions on LogoutResponse");
 			return "";
 		}
 		org.w3c.dom.Element element =  assertions.get(0);