←back to thread

Sign in as anyone: Bypassing SAML SSO authentication with parser differentials

(github.blog)
312 points campuscodi | 1 comments | 15 Mar 25 19:06 UTC | HN request time: 0s | source
Show context
kayodelycaon ◴[15 Mar 25 21:05 UTC] No.43375154[source]▶
Ugh. No one should use REXML unless they have no other choice. It will happily parse invalid xml, which causes an infinite number of problems downstream.

It’s quite literally parsing xml using regular expressions. It’s an excellent case study for why you shouldn’t do that.

Projects didn’t start using Nokogiri for performance. They used it because it’s correct.

replies(2): >>43375337 #>>43375770 #
LtWorf ◴[15 Mar 25 23:09 UTC] No.43375770[source]▶
> It’s quite literally parsing xml using regular expressions. It’s an excellent case study for why you shouldn’t do that.

It's like a textbook example no? Don't parse non-regular languages with regular expressions.

replies(1): >>43380466 #
1. wavemode ◴[16 Mar 25 17:04 UTC] No.43380466[source]▶
I would go further: don't parse with regular expressions. At all. They should be used for search (does this text contain something I'm looking for) not parsing (creating a syntax tree from unstructured input).