[OASIS Issue Tracker] Updated: (SECURITY-12) PE: Add material on RelayState sanitization

[ http://tools.oasis-open.org/issues/browse/SECURITY-12?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor updated SECURITY-12:
---------------------------------


Added to wd54 as E90.

> PE: Add material on RelayState sanitization
> -------------------------------------------
>
>                 Key: SECURITY-12
>                 URL: http://tools.oasis-open.org/issues/browse/SECURITY-12
>             Project: OASIS Security Services (SAML) TC
>          Issue Type: Improvement
>          Components: Bindings, Profiles
>    Affects Versions: Version 2.0
>            Reporter: Scott Cantor
>            Assignee: Scott Cantor
>             Fix For: 2.0 incorporating Approved Errata
>
>
> A recent paper (http://www.ai-lab.it/armando/pub/sec2011.pdf) outlines some threats that in small part involve problems with RelayState handling in implementations. Conversations with the author at the end of last year suggested we add clarifying material if possible to guide implementers to avoid some of the worst problems.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://tools.oasis-open.org/issues/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira