[
https://issues.apache.org/jira/browse/RAT-560?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18089493#comment-18089493
]
ASF subversion and git services commented on RAT-560:
-----------------------------------------------------
Commit b1cadc73fa4dc9b42bc3602b1375bdd74fb2438d in creadur-rat's branch
refs/heads/fix-xxe-issues from Philipp Ottlinger
[ https://gitbox.apache.org/repos/asf?p=creadur-rat.git;h=b1cadc73 ]
RAT-560: Add changelog entry and add test to verify no external entities can be
defined in xml input in RAT
> Static analysis shows XXE attack vectors - streamline usage in RAT and add
> documentation
> ----------------------------------------------------------------------------------------
>
> Key: RAT-560
> URL: https://issues.apache.org/jira/browse/RAT-560
> Project: Apache RAT
> Issue Type: Task
> Components: core engine
> Affects Versions: 0.18
> Reporter: Philipp Ottlinger
> Assignee: Claude Warren
> Priority: Major
> Fix For: 1.0.0
>
>
> Static code analysis warns that XML parsers used in RAT are
> vulnerable/potentially vulnerable to XXE attacks:
> * Reporter.java:99/140
> * XMLConfigurationReader:156/175
> As RAT runs on customer-owned data and allows custom configuration the usage
> in the code should be streamlined and documented.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
