See https://goo.gl/zuku4E. > The most obvious remediation here is ensuring your SAML library is extracting the full text of a given XML element when comments are present. Our implementation asks for the innerxml of the NameID field, so it returns the entire text including the comment (See https://goo.gl/KLLXof). By default Go's XML parsing would return the text not including the comment (but including further text after the comment). Both of these options prevent the vulnerability.