OpenSAML java withcomments canonicalization

[Bob Jacoby]

I'm trying to verify the "comment attack" is mitigated by using
http://www.w3.org/2001/10/xml-exc-c14n#WithComments canonicalization for
calculating the digest, but I'm not getting the digest to fail as I
expect. Does
OpenSAML (using v3.3.1) support this as a transform when performing
validation or am I just ignorant on how this is supposed to work?

For reference, I have a saml attribute with a value "helloworld" and then
sign the response - specifying
http://www.w3.org/2001/10/xml-exc-c14n#WithComments for both the
canonicalization method and the transform algorithm. I captured the
samlResponse and altered the value of the attribute to "hello<!---->world"
without changing anything else. I then validated the modified saml response.

Since the saml response specifies "...#WithComments" I had anticipated the
subsequent validation would fail when comparing the digests, but the whole
thing validated fine. I understand the BasicParserPool, by default, ignores
comments when unmarshalling (which would strip out the comments I added),
so I switched it to not ignore comments and verified the comment was loaded
when unmarshalling.

Is this as expected? If so, how is '
http://www.w3.org/2001/10/xml-exc-c14n#WithComments' any different from '
http://www.w3.org/2001/10/xml-exc-c14n' with respect to how they work
within OpenSAML?

Best,
Bob

For reference, my signedinfo is similar to:

<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="
http://www.w3.org/2001/10/xml-exc-c14n#WithComments"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#73651ce4-0ee9-4452-b063-c70657fb99dc">
<ds:Transforms>
<ds:Transform Algorithm="
http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments"><ec:InclusiveNamespaces
PrefixList="xsd" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#
"/></ds:Transform>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>MVm6t//vsyxMT7jt1KJl6Ef1G6Ie+f5ewTi54CHV4D8=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
EvT1KHe0o2h1pqtgQ7QsjTBJfoopDPgTgR7s1IY7asCxzYWdr95re290xwTPibMsxids36VYYcb1
S5UoXhUY2OCF4KXrWmyY2OVvDbGtKwW1QDTmzx1jaZCuOj+RPdtQaJVWg6YSwQFA7KlkyGtRvASb
nBmh2OkszTHGhB9dkPE=
</ds:SignatureValue>
</ds:Signature>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20180301/cc78ec49/attachment.html>