OneLogin::RubySaml::Response is broken on rexml 3.3.9

[msxavi]

Hi there,
Given an invalid SAMLResponse, the Response object now raises REXML::ParseException on rexml 3.3.9.

  1) SamlController POST #consume without an original page when invalid response
     Failure/Error:
       @sso_response ||= OneLogin::RubySaml::Response.new(
         params[:SAMLResponse],
         settings: sso_config.saml_settings,
         allowed_clock_drift: 60,
         skip_subject_confirmation: true
       )

     REXML::ParseException:
       Malformed XML: Content at the start of the document (got 'invalid')
       Line: 1
       Position: 7
       Last 80 unconsumed characters:
     # /usr/local/bundle/gems/rexml-3.3.9/lib/rexml/parsers/baseparser.rb:517:in `pull_event'

Which means the response interface is now broken on 1.17.0

response.is_valid?

Related to ruby/rexml#211

TIA

[pitbulk]

Hi @msxavi

We could catch the REXML::ParseException when building the Response (and others), and raise an ArgumentError similar than

raise ArgumentError.new("Response XML is invalid")

as we do here

[johnnyshields]

We need to get off REXML entirely and move to Nokogiri. REXML is not thread safe, and RubySaml patches it in a way that could potentially conflict with other gems.

[johnnyshields]

Work started here: #736