Description

Detects when SAML XML parser configurations allow comments in SAML responses. When comments are allowed in SAML processing, attackers could potentially inject malicious content within XML comments to bypass security controls or manipulate SAML assertions.

Detection Strategy

• Identifies calls to setIgnoreComments() method in Java code

• Verifies the method is called with 'false' as the argument

• Confirms the method is called on a BasicParserPool object instance

• Reports a vulnerability when all these conditions are met as this configuration allows potentially dangerous XML comments in SAML processing

Vulnerable code example

import org.opensaml.xml.parse.BasicParserPool;

public class SAMLVulnerable {
    public void configureParser() {
        BasicParserPool parserPool = new BasicParserPool();
        parserPool.setIgnoreComments(false); // Vulnerable: Allows XML comment injection attacks in SAML assertions
    }
}

✅ Secure code example

import org.opensaml.xml.parse.BasicParserPool;

public class SAMLSecure {
    public void configureParser() {
        BasicParserPool parserPool = new BasicParserPool();
        parserPool.setIgnoreComments(true); // Secure: Prevents XML comment injection attacks by ignoring comments
    }
}