Crash on nil-pointer dereference with malformed input about gosaml2 HOT 7 CLOSED

Hey @russellhaering what are your thoughts on patching this up and releasing a v0.6.1 ?

from gosaml2.

Are there any plans to roll out 0.6.1 so we can upgrade our dependencies?

from gosaml2.

Note that the example above needs to built with go.mod along the lines of

module example.com/foo

go 1.15

require (
	github.com/russellhaering/gosaml2 v0.6.0
)

Without using modules, the latest version of etree is pulled in which rejects the xml due to unbalanced xml tags i.e. with the following go.mod

module example.com/foo

go 1.15

require (
        github.com/beevik/etree v1.1.1-0.20200718192613-4a2f8b9d084c
	github.com/russellhaering/gosaml2 v0.6.0
)

the crasher no longer works.

from gosaml2.

This issue has been around for over a year now, a patch was proposed, yet nothing has been done to address the issue. So, I have to ask, is this project effectively dead?

from gosaml2.

@russellhaering could you please have a look? This vulnerability drives all devsecops tools crazy :) Thanks!

from gosaml2.

@lukyer To mitigate this we pinned the latest (untagged) commit on the main branch.

See #86 (comment)

from gosaml2.

@mfridman ah cool, thanks!

go get -u github.com/russellhaering/[email protected]

to the rescue :)

from gosaml2.