[
https://issues.apache.org/jira/browse/RAT-560?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18089678#comment-18089678
]
ASF subversion and git services commented on RAT-560:
-----------------------------------------------------
Commit 65695c07745dd7361803aed311307aaa161507e3 in creadur-rat's branch
refs/heads/fix-xxe-issues from Philipp Ottlinger
[ https://gitbox.apache.org/repos/asf?p=creadur-rat.git;h=65695c07 ]
RAT-560: Fix missing license
> Static analysis shows XXE attack vectors - streamline usage in RAT and add
> documentation
> ----------------------------------------------------------------------------------------
>
> Key: RAT-560
> URL: https://issues.apache.org/jira/browse/RAT-560
> Project: Apache RAT
> Issue Type: Task
> Components: core engine
> Affects Versions: 0.18
> Reporter: Philipp Ottlinger
> Assignee: Claude Warren
> Priority: Major
> Fix For: 1.0.0
>
>
> Static code analysis warns that XML parsers used in RAT are
> vulnerable/potentially vulnerable to XXE attacks:
> * Reporter.java:99/140
> * XMLConfigurationReader:156/175
> As RAT runs on customer-owned data and allows custom configuration the usage
> in the code should be streamlined and documented.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
