Merge pull request SAML-Toolkits#59 from assaydepot/fix_amp_regex

Detect already escaped ampersands
orslumen · Apr 3, 2013 · 8a99308 · 8a99308
2 parents 37547a8 + e605fc7
commit 8a99308
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/xml_security.rb b/lib/xml_security.rb
@@ -94,7 +94,7 @@ def validate_doc(base64_cert, soft = true)
 
         hashed_element                = document.at_xpath("//*[@ID='#{uri[1..-1]}']")
         canon_algorithm               = canon_algorithm REXML::XPath.first(ref, '//ds:CanonicalizationMethod', 'ds' => DSIG)
-        canon_hashed_element          = hashed_element.canonicalize(canon_algorithm, inclusive_namespaces).gsub('&','&amp;')
+        canon_hashed_element          = hashed_element.canonicalize(canon_algorithm, inclusive_namespaces).gsub(/&(?!amp;)/,'&amp;')
 
         digest_algorithm              = algorithm(REXML::XPath.first(ref, "//ds:DigestMethod"))