Weak authentication
ID |
scala.xml.scala_xml_rule_samlignorecomments |
Severity |
low |
Remediation Complexity |
trivial |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Xml |
Language |
Scala |
Rationale
Ignoring XML comments in SAML may lead to authentication bypass
The following code illustrates a vulnerable pattern detected by this rule:
// Keeping comments makes the parser see text the signature did not cover, which is how a
// comment injected into an assertion changes the identity it asserts.
class AssertionParsing {
@Bean private[xml] def pool = {
val parsers = new BasicParserPool
// VULNERABLE: Weak authentication
parsers.setIgnoreComments(false)
parsers
}
}Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.
References
-
OWASP Top 10 2025 - A02 : Security Misconfiguration.