Data Connector Depending on Attributes

[Cantor, Scott]

On 2/3/16, 8:32 PM, "users on behalf of Nate Klingenstein" <users-bounces at shibboleth.net on behalf of nate.klingenstein at utah.edu> wrote:



>The other risk to consider, now that I actually have the time to look at the logs more closely myself, is whether Velocity is somehow accidentally defeating the purpose of CDATA by turning things back into real characters anyway.  That would be unfortunate from a CSS perspective, probably, and maybe others.

CDATA is used to avoid having to encode lots of stuff into an XML text node when you need to use characters XML doesn't like. It doesn't protect against anything.

I don't see what XSS has to do with this at all, really, I think you're mixing up a lot of stuff here. LDAP search filters aren't driven by anything a user does other than a username, which is authenticated by the time it gets there.

-- Scott