SAML: attribute injection occurences