Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Disable external entities resolution in the default XML parser to prevent XXE attacks

Description

The default behavior of Java XML parsers is to happily resolve external XML entities, which exposes any application that processes unsecured XMLs to XXE vulnerabilities.

By default data.xml should initialize the XML parses with disabled XXE processing.

Environment

None

Attachments

1
  • 27 Aug 2014, 10:12 PM

Activity

Show:

Carlo SciollaSeptember 28, 2014 at 5:51 PM

Great, thanks!

Ryan SeniorSeptember 28, 2014 at 1:23 PM

Patch looks good, I've applied it. Thanks Carlo

Completed

Details

Assignee

Reporter

Labels

Patch

Code and Test

Priority

Created August 27, 2014 at 10:12 PM
Updated September 28, 2014 at 5:51 PM
Resolved September 28, 2014 at 5:51 PM

Flag notifications