Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updates from OIOSAML #6

Open
i8beef opened this issue Aug 31, 2016 · 1 comment
Open

Updates from OIOSAML #6

i8beef opened this issue Aug 31, 2016 · 1 comment

Comments

@i8beef
Copy link
Owner

i8beef commented Aug 31, 2016

I've attached a zip file that contains a port of the changes that were in OIOSAML.NET 1.7.9 to set the XMLResolver to NULL to prevent XML injection.
There is also a small change in the test app.config file to allow an additional test to be run when not building in the folder C:\Projects\SAML\Saml2

saml2_e9e23c273571.WithXMLChange.zip

i8beef added a commit that referenced this issue Aug 31, 2016
@i8beef
Copy link
Owner Author

i8beef commented Aug 31, 2016

I've looked at applying your changes, and while I basically understand where its going, because it affects so many files, I'm not sure how it affects XML serialization when you ARE using namespaces, and because I don't have anywhere to test it, I have it in a separate branch, and it needs testing before i merge it.

If we can get someone to test the 6-OIOSAML-1.7.9-XmlResolver-Changes branch, and ensure that this doesn't play havoc with any of the namespace serializations with documents generated herein, then I will merge it. I know this was an upstream change, so it's probably safe as we haven't diverged THAT much, but I'd still rather be safe than sorry on this one.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant