undefined | Better HN

0 pointsjupenur5y ago0 comments

Blog author here; Russell's implementation is backed by github.com/beevik/etree, but like you said, it's just an interface. The tokenizer is still encoding/xml.

Adding better support for namespaces and providing APIs compatible with dsig doesn't remove the underlying vulnerabilities.

0 comments

tptacek5y ago

Ugh. That's disappointing. I loathe SAML, but also think the right thing to do here is to make sure nobody uses encoding/xml as part of their SAML stack.

ptman5y ago

Pardon my ignorance, but what should be used instead of encoding/xml?

hakre5y ago

I think libxml does not have that problem, IIRC golang supports c-bindings.

1 more reply

GoblinSlayer5y ago

Huh, namespaces are a semantic convention on top of xml syntax, tokenizer can't really implement it.

rsc5y ago

This is like saying that variable name scoping is a semantic convention on top of the C language grammar and that a lexer can't really implement it. In the case of C, it turns out that the lexer must implement it. In the case of XML, processing name spaces directives during lexing is the right thing to do in nearly all cases. But it's not what these SAML libraries needed.

jupenurOP5y ago

Well that didn't stop them from trying

j / k navigate · click thread line to collapse