> For Vault, this turns into a security issue due to a somewhat surprising feature of the Go XML decoder: The decoder silently ignores non XML content before an

> For Vault, this turns into a security issue due to a somewhat surprising feature of the Go XML decoder: The decoder silently ignores non XML content before and after the expected XML root. I mean....Wow... I seriously wonder what the design consideration for the API of the XML decoder in Go was that they thought it was a good idea to simply ignore the stuff which is clearly invalid XML instead of erroring out. If I recall correctly it's even invalid XML to have a line break before the xml document declaration. But I guess in Go that would also be valid? These are exactly the kind of gotcha's in API's and languages that create security issues like these.