[jira] [Assigned] (DAFFODIL-1659) Turn off XML general entities - creates vulnerabilities

["Mike Beckerle (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/DAFFODIL-1659?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Mike Beckerle reassigned DAFFODIL-1659:
---------------------------------------

    Assignee: Mike Beckerle

> Turn off XML general entities - creates vulnerabilities
> -------------------------------------------------------
>
>                 Key: DAFFODIL-1659
>                 URL: https://issues.apache.org/jira/browse/DAFFODIL-1659
>             Project: Daffodil
>          Issue Type: Bug
>          Components: API, Back End, Front End
>            Reporter: Mike Beckerle
>            Assignee: Mike Beckerle
>            Priority: Major
>
> See: https://github.com/scala/scala-xml/issues/17
> For a discussion of turning off entities on XML. 
> We also need to turn off any way the XML parser would "go to the web" to resolve anything. This may already be off for parsing of DFDL schemas as we have our own resolver, but we also feed things to xerces for validation, and that might have these same issues, and when processing data, our streaming in of XML for unparsing may not be defending against this either.
> Places we take in XML:
> DFDL Schema
> TDML file
> Config file
> XML Catalog
> Validation of DFDL Schema in Xerces
> Validation of XML of DFDL Infoset in Xerces (This is our own XML being output from parser, so less of an issue, but we might as well just be uniform about all of these)
> XML Input to the unparser



--
This message was sent by Atlassian Jira
(v8.3.4#803005)