Comments (7)
Hey @russellhaering what are your thoughts on patching this up and releasing a v0.6.1
?
from gosaml2.
Are there any plans to roll out 0.6.1 so we can upgrade our dependencies?
from gosaml2.
Note that the example above needs to built with go.mod along the lines of
module example.com/foo
go 1.15
require (
github.com/russellhaering/gosaml2 v0.6.0
)
Without using modules, the latest version of etree is pulled in which rejects the xml due to unbalanced xml tags i.e. with the following go.mod
module example.com/foo
go 1.15
require (
github.com/beevik/etree v1.1.1-0.20200718192613-4a2f8b9d084c
github.com/russellhaering/gosaml2 v0.6.0
)
the crasher no longer works.
from gosaml2.
This issue has been around for over a year now, a patch was proposed, yet nothing has been done to address the issue. So, I have to ask, is this project effectively dead?
from gosaml2.
@russellhaering could you please have a look? This vulnerability drives all devsecops tools crazy :) Thanks!
from gosaml2.
@lukyer To mitigate this we pinned the latest (untagged) commit on the main branch.
See #86 (comment)
from gosaml2.
@mfridman ah cool, thanks!
go get -u github.com/russellhaering/[email protected]
to the rescue :)
from gosaml2.
Related Issues (20)
- assertionInfo.WarningInfo.InvalidTime using time finer than milliseconds
- Security policy link not working HOT 1
- Support Uncompressed SAML
- How to ignore the received public encryption certificate
- Possible Vulnerability: Auth Request sends the service providers validation certificate HOT 2
- panic on crypto/cipher: input not full blocks
- IdentityProviderSSOBinding and buildAuthnRequest HOT 1
- SPKeyStore HOT 2
- Does not work with samltest.id HOT 1
- Reparse the signed XML
- How do i generate SP MetaData File Using gosaml2 HOT 1
- Push a new tag and release HOT 2
- Add proper documentation on different functions available HOT 2
- samlp:NameIDPolicy Format attribute is written even if unspecified, causing Azure AD problems HOT 2
- HTTP-Redirect: Missing Signature and SigAlg parameters in SAMLRequest Url (AuthNRequest) HOT 1
- Sso saml for okta using this package
- Decrypt assertion returns wrong error value HOT 1
- validate does not check SessionNotOnOrAfter for expiration
- Missing exported function BuildAuthURLWithRedirect HOT 1
- [CVE-2020-7731] CWE-476: NULL Pointer Dereference? HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from gosaml2.