Skip to content

Ignoring XML comments in SAML

Description

Ignoring XML comments in SAML may lead to authentication bypass

Examples

Insecure Code

scala
val pool = new BasicParserPool(); pool.setIgnoreComments(false);

Secure Code

scala
val pool = new BasicParserPool(); pool.setIgnoreComments(true);

Remediation

Set ignoreComments to true in the BasicParserPool to prevent authentication bypass

Rule Details

FieldValue
IDCODE-0079
CategoryAuth
SeverityMEDIUM
CWECWE-1390
ConfidenceHIGH
ImpactHIGH
LikelihoodMEDIUM
ExploitabilityMODERATE
TagsSAML, authentication
OWASPN/A