Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ParseException on 3.3.3 #211

Closed
msxavi opened this issue Oct 8, 2024 · 3 comments
Closed

ParseException on 3.3.3 #211

msxavi opened this issue Oct 8, 2024 · 3 comments

Comments

@msxavi
Copy link

msxavi commented Oct 8, 2024

Hi there,

Before 3.3.3 I was able to access an invalid SamlResponse e.g:

 response ||= OneLogin::RubySaml::Response.new(
    "invalid",
    :settings => @config.saml_settings,
    :allowed_clock_drift => 60,
    :skip_subject_confirmation => true
  )

 response.name_id # returns nil on 3.3.2 and ruby-saml 1.17.0

On 3.3.3 all the way to 3.3.8, ParseException is now raised:

     REXML::ParseException:
       Malformed XML: Content at the start of the document (got 'invalid')
       Line: 1
       Position: 7
       Last 80 unconsumed characters:
     # /usr/local/bundle/gems/rexml-3.3.3/lib/rexml/parsers/baseparser.rb:487:in `pull_event'
     # /usr/local/bundle/gems/rexml-3.3.3/lib/rexml/parsers/baseparser.rb:218:in `pull'
     # /usr/local/bundle/gems/rexml-3.3.3/lib/rexml/parsers/treeparser.rb:22:in `parse'
     # /usr/local/bundle/gems/rexml-3.3.3/lib/rexml/document.rb:448:in `build'
     # /usr/local/bundle/gems/rexml-3.3.3/lib/rexml/document.rb:101:in `initialize'
     # /usr/local/bundle/gems/ruby-saml-1.17.0/lib/xml_security.rb:191:in `initialize'

TIA.

@kou
Copy link
Member

kou commented Oct 8, 2024

This is an intentional fix.

XML processors must report non well-formed violations:

https://www.w3.org/TR/2006/REC-xml11-20060816/#proc-types

Validating and non-validating processors alike MUST report violations of this specification's well-formedness constraints in the content of the document entity and any other parsed entities that they read.

@kou kou closed this as not planned Won't fix, can't repro, duplicate, stale Oct 8, 2024
@msxavi
Copy link
Author

msxavi commented Oct 8, 2024

@kou Sure, my point is that it doesn't look like a patch fix if that causes backward incompatibilities.

@kou
Copy link
Member

kou commented Oct 8, 2024

REXML doesn't use semantic versioning.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants