{"record":{"id":"434c901d85e32071","repo":"spring-projects/spring-security","slug":"failed-to-deserialize-payload-434c90","errorCode":null,"errorMessage":"Failed to deserialize payload","messagePattern":"Failed to deserialize payload","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/metadata/OpenSaml5Template.java","lineNumber":160,"sourceCode":"\t@Override\n\tpublic <T extends XMLObject> T deserialize(InputStream serialized) {\n\t\ttry {\n\t\t\tParserPool pool = XMLObjectProviderRegistrySupport.getParserPool();\n\t\t\tAssert.notNull(pool, \"ParserPool must be configured\");\n\t\t\tDocument document = pool.parse(serialized);\n\t\t\tElement element = document.getDocumentElement();\n\t\t\tUnmarshallerFactory factory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();\n\t\t\tUnmarshaller unmarshaller = factory.getUnmarshaller(element);\n\t\t\tif (unmarshaller == null) {\n\t\t\t\tthrow new Saml2Exception(\"Unsupported element of type \" + element.getTagName());\n\t\t\t}\n\t\t\treturn (T) unmarshaller.unmarshall(element);\n\t\t}\n\t\tcatch (Saml2Exception ex) {\n\t\t\tthrow ex;\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new Saml2Exception(\"Failed to deserialize payload\", ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic OpenSaml5SerializationConfigurer serialize(XMLObject object) {\n\t\tMarshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object);\n\t\tAssert.notNull(marshaller, \"Marshaller for \" + object.getElementQName() + \" must be configured\");\n\t\ttry {\n\t\t\treturn serialize(marshaller.marshall(object));\n\t\t}\n\t\tcatch (MarshallingException ex) {\n\t\t\tthrow new Saml2Exception(ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic OpenSaml5SerializationConfigurer serialize(Element element) {\n\t\treturn new OpenSaml5SerializationConfigurer(element);","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/metadata/OpenSaml5Template.java#L142-L178","documentation":"The metadata-package copy of OpenSaml5Template.deserialize(): any non-Saml2Exception failure while parsing or unmarshalling the payload (SAX parse errors, schema violations, ParserPool problems) is wrapped in this Saml2Exception with the root cause attached. The input could not be converted to an OpenSAML XMLObject.","triggerScenarios":"Calling OpenSaml5Template.deserialize(String) with malformed or schema-invalid metadata XML — truncated documents, invalid XML characters, encoding mismatch, duplicate IDs, or an unparseable body returned by a metadata endpoint.","commonSituations":"Metadata endpoints behind proxies/CDNs returning partial or garbage bodies; metadata fetched with wrong charset handling; IdP emitting invalid XML (unescaped '&', malformed entities); network truncation of large metadata files.","solutions":["Log ex.getCause() (usually a SAXParseException with line/column) to locate the malformed part of the document.","Confirm the metadata body is complete and correctly encoded (UTF-8); check for proxy/CDN truncation and Content-Length mismatches.","Re-fetch the metadata and compare — transient truncation is fixed by retry with backoff.","Validate the document against the SAML metadata schema and raise the issue with the IdP if it emits invalid XML."],"exampleFix":"// before\nEntityDescriptor ed = template.deserialize(truncatedBody);\n// Saml2Exception: Failed to deserialize payload\n// after\ntry {\n    EntityDescriptor ed = template.deserialize(body);\n} catch (Saml2Exception ex) {\n    throw new Saml2Exception(\"Invalid metadata from \" + metadataUrl + \": \" + ex.getCause().getMessage(), ex);\n}","handlingStrategy":"try-catch","validationCode":"if (body == null || body.trim().length() == 0) {\n    throw new IllegalStateException(\"Metadata body is empty\");\n}\nif (expectedLength > 0 && body.length() < expectedLength) {\n    throw new IllegalStateException(\"Metadata body truncated (\" + body.length() + \" of \" + expectedLength + \" bytes)\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    EntityDescriptor ed = template.deserialize(body);\n} catch (Saml2Exception ex) {\n    Throwable cause = ex.getCause();\n    logger.warn(\"Metadata parse failed at {}\", cause == null ? \"unknown\" : cause.getMessage());\n    throw new Saml2Exception(\"Invalid metadata from endpoint\", ex);\n}","preventionTips":["Log ex.getCause() (SAXParseException line/column) to locate malformed metadata.","Verify Content-Length vs body length to detect proxy/CDN truncation.","Read and write metadata as UTF-8 explicitly.","Retry fetch with backoff on transient truncation; report invalid XML to the IdP."],"tags":["saml2","opensaml","metadata","xml-parse"],"backgroundTag":"xml-unmarshal-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}