SAML NameID comment injection

Some XML libraries return only the text before a comment when reading a node, while the signature still validates over the whole element. Insert a comment to change the effective identity without breaking the signature.

[email protected][email protected]

Test how the consumer parses the node.

# submit both variants and compare which identity the app logs you in as
saml_raider --comment-inject --target https://sp/acs

Pro note: the bug depends on the SP’s XML text extraction, so it is worth trying even when the signature is strictly validated. Combine with case and whitespace tricks around the email. Patched libraries normalize text nodes, so note the exact library and version.