This is an automated email from the ASF dual-hosted git repository. ottlinger pushed a commit to branch feature/RAT-558 in repository https://gitbox.apache.org/repos/asf/creadur-rat.git
commit f492f7a4be4f64ffa0bbdb7cae95871d6509a33d Author: P. Ottlinger <[email protected]> AuthorDate: Mon Jun 1 21:46:52 2026 +0200 RAT-558: Add SECURITY proposal concerning XXE warnings --- SECURITY.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..ec85a3c8 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,11 @@ +# Security + +TBD + +## Known Non-Findings + +- Static code analysis may report `XXE_DOCUMENT` vulnerabilities because RAT reads XML and XSLT files provided as user input. + + - Configuration files and XSLT documents passed to RAT are operator-controlled configuration, not request input. Reports claiming SSRF or path traversal via these resolvers, based on the assumption that the resource name is attacker-controlled, are out of scope under the documented threat model. XML and XSLT authorship, as well as resource configuration, are privileged operations. + + - Applications that thread untrusted input into XML configuration or XSLT documents should validate that input before passing it to RAT. Responsibility for such validation rests with the application, not with RAT.
