OpenSAML-Java susceptible to comment attack?

[Brent Putman]

On 2/27/18 10:21 PM, Marc Boorshtein wrote:
> I haven't tried this, but the advisory only mentions the OpenSAML-C
> libraries.  Is it known if this effects the opensaml java libs?

It does not. At least, not if you are using our ParserPool impl with
default settings.   We completely strip out the comments when we parse
the input into the DOM.  So there's never any comments in the DOM.

We've always done this back to early days, simply because we don't
support preserving comments at all in the marshalling/unmarshalling
process.  So turned out to be a happy coincidence with respect to this
vulnerability.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20180227/9503a254/attachment.html>