[
https://issues.apache.org/jira/browse/SLING-13336?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Joerg Hoh updated SLING-13336:
------------------------------
Fix Version/s: XSS Protection API 2.4.12
> Missing resource limits in XML/JSON validation
> ----------------------------------------------
>
> Key: SLING-13336
> URL: https://issues.apache.org/jira/browse/SLING-13336
> Project: Sling
> Issue Type: Improvement
> Components: XSS Protection API
> Reporter: Joerg Hoh
> Assignee: Joerg Hoh
> Priority: Major
> Fix For: XSS Protection API 2.4.12
>
>
> Utility methods that validate XML and JSON input did not configure resource
> limits appropriate for handling untrusted input. This could, under certain
> conditions, allow specially crafted input to cause excessive resource
> consumption. Also disallow DOCTYPE/internal-entity expansion.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
