Collected research

Securing XML implementations across the web

Juho Forsén · Mattermost.com · 28 July 2021

Several XML implementations do not round-trip documents faithfully: parsing and re-serialising a crafted document changes its structure, because mismatched quotes in a notation declaration let a system identifier swallow following markup. SAML libraries read the identity before validating the signature but validate after a round-trip, so one signed document logs an attacker in as anyone.

Record

Researcher

Juho Forsén

Published by

Mattermost.com

Date

28 July 2021

Topic

Other

In the archive

• Collected in the 2021 research round

Related sources

• xmldom advisory Advisory
• Coordinated disclosure: Go XML vulnerabilities

Tags

• parser-differential
• auth-bypass
• saml
• sso
• ruby
• nodejs
• java
• dotnet
• cve
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Juho Forsén, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.