OpenSAML and Apache Santuario (xmlsec) 1.5.1

[Cantor, Scott]

> BTW:  The org.opensaml.security.SAMLSignatureProfileValidator still uses
> IdResolver.getElementById(doc, uriID) (line 150). I inherited this
> validator and basically dropped the check. I guess I should have used
> Document.getElementById(..) here as well.

That would be very wrong to do. The entire point of the check is to run the same resolution process as the library runs. Anything more or less defeats the check and opens the system to the wrapping attack it fixed.

-- Scott