[
https://issues.apache.org/jira/browse/RAT-560?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18089754#comment-18089754
]
ASF subversion and git services commented on RAT-560:
-----------------------------------------------------
Commit 0379d9ac5aa6fb75787bf7616ea188d5ebcec78e in creadur-rat's branch
refs/heads/master from Philipp Ottlinger
[ https://gitbox.apache.org/repos/asf?p=creadur-rat.git;h=0379d9ac ]
RAT-560: Fix sonar warnings
> Static analysis shows XXE attack vectors - streamline usage in RAT and add
> documentation
> ----------------------------------------------------------------------------------------
>
> Key: RAT-560
> URL: https://issues.apache.org/jira/browse/RAT-560
> Project: Apache RAT
> Issue Type: Task
> Components: core engine
> Affects Versions: 0.18
> Reporter: Philipp Ottlinger
> Assignee: Claude Warren
> Priority: Major
> Fix For: 1.0.0
>
>
> Static code analysis warns that XML parsers used in RAT are
> vulnerable/potentially vulnerable to XXE attacks:
> * Reporter.java:99/140
> * XMLConfigurationReader:156/175
> As RAT runs on customer-owned data and allows custom configuration the usage
> in the code should be streamlined and documented.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
