coheigea opened a new pull request, #407: URL: https://github.com/apache/cxf-xjc-utils/pull/407
The -catalog file was parsed with external DTD/entity resolution enabled, so a malicious catalog could read local files or make network requests just by being parsed (XXE). Parsing now disallows external DTD and schema access, restored immediately afterward, so schema parsing and classpath:/http: catalog entries are unchanged. This is a scoped hardening of the catalog parse; it does not restrict the resolver’s fetching of cataloged entries (left as-is to avoid breaking legitimate catalogs), and both require an attacker-controlled catalog, so practical severity is low. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
