Skip to content

Conversation

@pitbulk
Copy link
Collaborator

@pitbulk pitbulk commented Nov 30, 2025

  • Rename safe_load_nokogiri into safe_load_xml.
  • Refactor of safe_load_xml method.
  • Improve how handle XML that contains syntax errors, added test.
  • Prevent exceptions on .at_xpath called when the document was not loaded and user invoke elements accesor by checking the @document is not nil.

@pitbulk pitbulk force-pushed the v2.x_safe_load_refactor branch from 5278ea6 to 0e9e57d Compare November 30, 2025 10:42
@pitbulk pitbulk force-pushed the v2.x_safe_load_refactor branch from 0e9e57d to a7c847f Compare November 30, 2025 10:58
@pitbulk
Copy link
Collaborator Author

pitbulk commented Dec 1, 2025

@johnnyshields, @ahacker1-securesaml any chance to check my PR? Thanks

@ahacker1-securesaml
Copy link
Contributor

I think this is good (security-wise). I'm not really concerned about XML parsing, what I am most concerned about is the signature verification components.

Right before releases 2.x, I will raise my concerns about the SignedDocumentValidator class

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants