mirror of
https://github.com/fleetdm/fleet
synced 2026-05-24 09:28:54 +00:00
23a12b2ab0
See https://goo.gl/zuku4E. > The most obvious remediation here is ensuring your SAML library is extracting the full text of a given XML element when comments are present. Our implementation asks for the innerxml of the NameID field, so it returns the entire text including the comment (See https://goo.gl/KLLXof). By default Go's XML parsing would return the text not including the comment (but including further text after the comment). Both of these options prevent the vulnerability. |
||
|---|---|---|
| .. | ||
| config | ||
| contexts | ||
| datastore | ||
| health | ||
| kolide | ||
| launcher | ||
| logwriter | ||
| mock | ||
| pubsub | ||
| service | ||
| sso | ||
| test | ||
| websocket | ||