Samin061 opened a new pull request, #71423: URL: https://github.com/apache/airflow/pull/71423
`_fetch_saml_assertion_using_http_spegno_auth` parses the IdP HTTP response with lxml's default parser, which resolves external entities, so an IdP endpoint (a malicious or on-path one) can return a DOCTYPE whose `SYSTEM` entity reads a local file into the extracted assertion, or a nested-entity payload that exhausts worker memory. The response is remote content rather than trusted local config, so it should be parsed with entity resolution and network access off. This parses it with a hardened `XMLParser(resolve_entities=False, no_network=True, load_dtd=False)`. --- ##### Was generative AI tooling used to co-author this PR? - [ ] Yes (please specify the tool below) --- * Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
