Sign in as anyone: Bypassing SAML SSO authentication with parser differentials

Ugh. No one should use REXML unless they have no other choice. It will happily parse invalid xml, which causes an infinite number of problems downstream.

It’s quite literally parsing xml using regular expressions. It’s an excellent case study for why you shouldn’t do that.

Projects didn’t start using Nokogiri for performance. They used it because it’s correct.

One of risks of AI code assistance is that they are not necessarily looking at the wider picture when it comes to libraries used on a large code base

I was testing o3 recently and it kept changing the library used by a block of code every time it tried to fix an issue in the block that was unrelated to the library used (haven't seen that happen with Sonnet)

Easy to see how issues could creep in because a modification is made that switches to an inferior library/gem that exists in the code base or standard library so still passes tests etc. but doesn't need a Gemfile change

> It’s quite literally parsing xml using regular expressions. It’s an excellent case study for why you shouldn’t do that.

It's like a textbook example no? Don't parse non-regular languages with regular expressions.

I would go further: don't parse with regular expressions. At all. They should be used for search (does this text contain something I'm looking for) not parsing (creating a syntax tree from unstructured input).