Golang XML vulnerabilities

[mdosch]

FYI

https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.md https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md

[licaon-kter]

Ref: https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/

[Neustradamus]

@mdosch, @licaon-kter: Thanks for this information :)

[prefiks]

Not sure if this is really problem for this library, i think what this vulnerability is that if you have element like <test:a xmlns:test="abc" xmlns:test2="abc"/> after parsing and serializing it back you could get <test2:a xmlns:test="abc" xmlns:test2="abc"/>, but i don't think this will be problem for us - we don't require original namespaces, and i don't even think we serialize back values that we parsed previously.