←back to thread

Sign in as anyone: Bypassing SAML SSO authentication with parser differentials

(github.blog)
312 points campuscodi | 1 comments | 15 Mar 25 19:06 UTC | HN request time: 0.203s | source
Show context
kayodelycaon ◴[15 Mar 25 21:05 UTC] No.43375154[source]▶
Ugh. No one should use REXML unless they have no other choice. It will happily parse invalid xml, which causes an infinite number of problems downstream.

It’s quite literally parsing xml using regular expressions. It’s an excellent case study for why you shouldn’t do that.

Projects didn’t start using Nokogiri for performance. They used it because it’s correct.

replies(2): >>43375337 #>>43375770 #
1. mtkd ◴[15 Mar 25 21:40 UTC] No.43375337[source]▶
One of risks of AI code assistance is that they are not necessarily looking at the wider picture when it comes to libraries used on a large code base

I was testing o3 recently and it kept changing the library used by a block of code every time it tried to fix an issue in the block that was unrelated to the library used (haven't seen that happen with Sonnet)

Easy to see how issues could creep in because a modification is made that switches to an inferior library/gem that exists in the code base or standard library so still passes tests etc. but doesn't need a Gemfile change