Uploaded image for project: 'WildFly Core'
  1. WildFly Core
  2. WFCORE-5594

Restriction of XML External Entity Reference (XXE)

    XMLWordPrintable

Details

    Description

      Currently some codepoints use a native javax.xml.parsers.DocumentBuilderFactory or javax.xml.stream.XMLInputFactory. Restriction of XML External Entity Reference is lacking.

      Fix:

      • Provide factories setting secure defaults
      • Use the new factories at relevant places

      Related to:

      This issue depends on the work of ropalka who fixes the usage of xalan/xerces and JDK provided libraries.

      Attachments

        Issue Links

          Activity

            People

              xf01213 Boris Unckel
              xf01213 Boris Unckel
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: