Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-8103

[7.0] Mention danger of XXE attack if some resteasy parameters are set to non default values

XMLWordPrintable

      Book: Developing webservices applications
      Chapter: 2.10. Securing JAX-RS Web Services

      Resteasy has three parameters which are protection against XML external entity attack.
      These parameters are have default values set in a way that resteasy is protected against it.

      This chapter shoul contain warning that changing default values of these three parameters may cause REST application to be potentially vulnerable against XXE attack.

      The mentioned parameters are:

      • resteasy.document.expand.entity.references
      • resteasy.document.secure.processing.feature
      • resteasy.document.secure.disableDTDs
        (all documented in A.2. RESTEasy Configuration Parameters chapter)

              rhn-engineering-nchaudha Nidhi Chaudhary
              sgilda_jira Sande Gilda (Inactive)
              Katerina Odabasi Katerina Odabasi
              Katerina Odabasi Katerina Odabasi
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: