Files
fleet/server
Zachary Wasserman 23a12b2ab0 Add check for Duo SAML vulnerability (not vulnerable) (#1718)
See https://goo.gl/zuku4E.

> The most obvious remediation here is ensuring your SAML library is extracting
  the full text of a given XML element when comments are present.

Our implementation asks for the innerxml of the NameID field, so it returns the
entire text including the comment (See https://goo.gl/KLLXof). By default Go's
XML parsing would return the text not including the comment (but including
further text after the comment). Both of these options prevent the
vulnerability.
2018-03-02 09:44:23 -07:00
..
2017-12-21 18:37:32 -08:00
2017-12-21 18:37:32 -08:00