[
https://issues.apache.org/jira/browse/SLING-13336?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Joerg Hoh updated SLING-13336:
------------------------------
Description:
Utility methods that validate XML and JSON input did not configure resource
limits appropriate for handling untrusted input. This could, under certain
conditions, allow specially crafted input to cause excessive resource
consumption. Also disallow DOCTYPE/internal-entity expansion.
h5. Details
* XSSAPIImpl: getValidXML accepts DOCTYPE with internal entity expansion
* XSSAPIImpl: getValidJSON deep nesting causes uncaught StackOverflowError
Commit:
https://github.com/apache/sling-org-apache-sling-xss/commit/5068327007f2c38abc16ceb1fcaac06dbc5f09ef
was:Utility methods that validate XML and JSON input did not configure
resource limits appropriate for handling untrusted input. This could, under
certain conditions, allow specially crafted input to cause excessive resource
consumption. Also disallow DOCTYPE/internal-entity expansion.
> Missing resource limits in XML/JSON validation
> ----------------------------------------------
>
> Key: SLING-13336
> URL: https://issues.apache.org/jira/browse/SLING-13336
> Project: Sling
> Issue Type: Improvement
> Components: XSS Protection API
> Reporter: Joerg Hoh
> Assignee: Joerg Hoh
> Priority: Major
> Fix For: XSS Protection API 2.4.12
>
>
> Utility methods that validate XML and JSON input did not configure resource
> limits appropriate for handling untrusted input. This could, under certain
> conditions, allow specially crafted input to cause excessive resource
> consumption. Also disallow DOCTYPE/internal-entity expansion.
> h5. Details
> * XSSAPIImpl: getValidXML accepts DOCTYPE with internal entity expansion
> * XSSAPIImpl: getValidJSON deep nesting causes uncaught StackOverflowError
> Commit:
> https://github.com/apache/sling-org-apache-sling-xss/commit/5068327007f2c38abc16ceb1fcaac06dbc5f09ef
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
