[
https://issues.apache.org/jira/browse/SLING-13336?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Joerg Hoh updated SLING-13336:
------------------------------
Description: Utility methods that validate XML and JSON input did not
configure resource limits appropriate for handling untrusted input. This could,
under certain conditions, allow specially crafted input to cause excessive
resource consumption. Also disallow DOCTYPE/internal-entity expansion. (was:
Utility methods that validate XML and JSON input did not configure resource
limits appropriate for handling untrusted input. This could, under certain
conditions, allow specially crafted input to cause excessive resource
consumption. )
> Missing resource limits in XML/JSON validation
> ----------------------------------------------
>
> Key: SLING-13336
> URL: https://issues.apache.org/jira/browse/SLING-13336
> Project: Sling
> Issue Type: Improvement
> Components: XSS Protection API
> Reporter: Joerg Hoh
> Priority: Major
>
> Utility methods that validate XML and JSON input did not configure resource
> limits appropriate for handling untrusted input. This could, under certain
> conditions, allow specially crafted input to cause excessive resource
> consumption. Also disallow DOCTYPE/internal-entity expansion.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
