This is actually a violation of the "see what is signed" principle. When verifying an XML signature, you need to only look at the data that was signed, and dis

This is actually a violation of the "see what is signed" principle. When verifying an XML signature, you need to only look at the data that was signed, and disregard everything else. The XML Signature standard defines a number of "transforms", one of which is canonicalization, which may or may not strip comments. Only data that has been transformed is signed. This means an application relying on signature verification should never look at untransformed data! Comments are not the only attack source - the XML Signature standard allows "custom transforms" which can do crazy stuff like evaluation of xpath-based filters. The "see what is signed" principle is simple and has little to do with SAML. Canonicalized data that passed signature verification is the only data that the relying application should look at. The signature verification library should not allow access to anything else. If I understand everything correctly, my implementation https://github.com/XML-Security/signxml https://github.com/XML-Security/signxml is not vulnerable because it obeys the rule above.