Detect already escaped ampersands

orslumen · Jan 22, 2013 · e605fc7 · e605fc7
1 parent 25173fe
commit e605fc7
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/xml_security.rb b/lib/xml_security.rb
@@ -90,7 +90,7 @@ def validate_doc(base64_cert, soft = true)
 
         hashed_element                = document.at_xpath("//*[@ID='#{uri[1..-1]}']")
         canon_algorithm               = canon_algorithm REXML::XPath.first(ref, '//ds:CanonicalizationMethod', 'ds' => DSIG)
-        canon_hashed_element          = hashed_element.canonicalize(canon_algorithm, inclusive_namespaces).gsub('&','&amp;')
+        canon_hashed_element          = hashed_element.canonicalize(canon_algorithm, inclusive_namespaces).gsub(/&(?!amp;)/,'&amp;')
 
         digest_algorithm              = algorithm(REXML::XPath.first(ref, "//ds:DigestMethod"))