Samin061 commented on PR #71423: URL: https://github.com/apache/airflow/pull/71423#issuecomment-5339334322
Added test_saml_assertion_parsing_does_not_resolve_internal_entities. It uses an inline entity defined in the DOCTYPE (<!ENTITY payload "INJECTED">) instead of a SYSTEM one, and asserts the value isn't expanded into the extracted assertion. Confirmed it fails on the old default parser (the entity expands to INJECTED) and passes with the hardened parser. Good catch on the coverage gap. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
