Update xmlseclibs to 3.1.4 due CVE-2025-66475

Author: pitbulk

onelogin-saml-sso/php/extlib/xmlseclibs/CHANGELOG.txt

@@ -1,5 +1,19 @@
 xmlseclibs.php
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+08, Dec 2025, 3.1.4
+Security:
+- fix canonicalization bypass error (d0ge)
+
+20, Nov 2024, 3.1.3
+Bug Fixes:
+- remove loadKey check due to BC issues
+
+20, Nov 2024, 3.1.2
+Improvements:
+- Add tab to list of whitespace values to remove from cert. refs #252
+- loadKey should check return value for openssl_get_privatekey (sammarshallou)
+- Switch to GitHub actions (SharkMachine)
+
 05, Sep 2020, 3.1.1
 Features:
 - Support OAEP (iggyvolz)

onelogin-saml-sso/php/extlib/xmlseclibs/src/XMLSecurityDSig.php

@@ -293,7 +293,11 @@ private function canonicalizeData($node, $canonicalmethod, $arXPath=null, $prefi
             }
         }
 
-        return $node->C14N($exclusive, $withComments, $arXPath, $prefixList);
+        $ret = $node->C14N($exclusive, $withComments, $arXPath, $prefixList);
+        if ($ret === false) {
+            throw new Exception("Canonicalization failed");
+        }
+        return $ret;
     }
 
     /**
@@ -1050,7 +1054,7 @@ public static function staticAdd509Cert($parentRef, $cert, $isPEMFormat=true, $i
                             }
                             $subjectNameValue = implode(',', $parts);
                         } else {
-                            $subjectNameValue = $certData['issuer'];
+                            $subjectNameValue = $certData['subject'];
                         }
                         $x509SubjectNode = $baseDoc->createElementNS(self::XMLDSIGNS, $dsig_pfx.'X509SubjectName', $subjectNameValue);
                         $x509DataNode->appendChild($x509SubjectNode);

onelogin-saml-sso/php/extlib/xmlseclibs/xmlseclibs.php

@@ -2,7 +2,7 @@
 /**
  * xmlseclibs.php
  *
- * Copyright (c) 2007-2020, Robert Richards <rrichards@cdatazone.org>.
+ * Copyright (c) 2007-2025, Robert Richards <rrichards@cdatazone.org>.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -35,9 +35,9 @@
  * POSSIBILITY OF SUCH DAMAGE.
  *
  * @author    Robert Richards <rrichards@cdatazone.org>
- * @copyright 2007-2020 Robert Richards <rrichards@cdatazone.org>
+ * @copyright 2007-2025 Robert Richards <rrichards@cdatazone.org>
  * @license   http://www.opensource.org/licenses/bsd-license.php  BSD License
- * @version   3.1.1
+ * @version   3.1.4
  */
 
 $xmlseclibs_srcdir = dirname(__FILE__) . '/src/';