You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@sling.apache.org by "Joerg Hoh (Jira)" <ji...@apache.org> on 2026/09/18 10:15:00 UTC

[jira] [Closed] (SLING-13336) Missing resource limits in XML/JSON validation

     [ https://issues.apache.org/jira/browse/SLING-13336?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Joerg Hoh closed SLING-13336.
-----------------------------

> Missing resource limits in XML/JSON validation
> ----------------------------------------------
>
>                 Key: SLING-13336
>                 URL: https://issues.apache.org/jira/browse/SLING-13336
>             Project: Sling
>          Issue Type: Improvement
>          Components: XSS Protection API
>            Reporter: Joerg Hoh
>            Assignee: Joerg Hoh
>            Priority: Major
>             Fix For: XSS Protection API 2.4.12
>
>
> Utility methods that validate XML and JSON input did not configure resource limits appropriate for handling untrusted input. This could, under certain conditions, allow specially crafted input to cause excessive resource consumption. Also disallow DOCTYPE/internal-entity expansion.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)