Remove all reference XML data if any are corrupted

[cjbarth]

No description provided.

[markstos]

Makes sense. Given this change, do we still need the TODO comments, or does this change address that goal?

// TODO: add this breaking change here later on for even more security: this.references = [];

[cjbarth]

Given this change, do we still need the TODO comments, or does this change address that goal?

It depends on your perspective. On the one hand the current code prevents the unverified XML from getting to the consumer, but leave the other information about the existence of a reference visible. So, if it is acceptable (desirable?) to show that a reference is there, but unverified, then we're done. Otherwise, if we want to just fail the entire payload if it is corrupted in some way, then we have to leave that TODO there.

I'm under the impression that we need to just fail the entire payload if there is any corruption. If it is bad, the most secure thing to do is to throw it away. We are doing forensics such that we want to keep that kind of thing around and make the best of it IMO.

[markstos]

Makes sense. In that case, approved as-is.