Skip to content

Don't parse html with xml parser #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
liquidpele wants to merge 5 commits into from
Closed

Don't parse html with xml parser #53

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
b60149c
Don't parse html with xml parser, and instead get the data we need di…
Apr 11, 2017
d732a3b
Don't use the private method
Apr 11, 2017
43d182e
Remove un-used import, utilize the default option of getattr
Apr 11, 2017
501095a
Merge in my other PR about failing back to supported idp bindings, an…
Apr 12, 2017
2868b31
Somehow deleted the get_location method?
Apr 12, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Don't use the private method
  • Loading branch information
Reece authored and Reece committed Apr 11, 2017
commit d732a3bd003fd1544ad55b310806ba13f829f989
2 changes: 1 addition & 1 deletion djangosaml2/views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,7 +180,7 @@ def login(request,
else:
# manually get request XML to build our own template
request_id, request_xml = client.create_authn_request(
Copy link
Collaborator

@knaperek knaperek Apr 12, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't like doing this :-(.
We already have a result from prepare_for_authenticate, now we should disregard it and ask for a new, just because we can "parse it better"?
I take it that you're trying to fine-tune the code and I appreciate it, but this is ain't broke (it works!) and I prefer stability here. There's really no need to do this in my opinion.

Copy link
Contributor Author

@liquidpele liquidpele Apr 12, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh no, it's still very broken if you have any characters in your IDP SSO url that choke an xml parser. I only fixed the & because the was one we had happen in the field, and I intended it only as a temporary fix until I dug more into pysaml2.

I can change it so it does only one or the other instead of both in that case if you like, but explicitly getting the parameters instead of parsing them from html that pysaml2 generates is going to be far less bug-prone. Do you want me to go ahead and have it only do one or the other?

client._sso_location(selected_idp, binding),
client.sso_location(selected_idp, binding),
binding=binding)
return render(request, post_binding_form_template, {
'target_url': result['url'],
Expand Down