[jira] [Comment Edited] (SOLR-16296) Load elevate.xml in a more secure way

["David Smiley (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SOLR-16296?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17572524#comment-17572524 ] 

David Smiley edited comment on SOLR-16296 at 7/28/22 3:40 PM:
--------------------------------------------------------------

I don't think changing the formats is worth the effort.  Formats like XML, JSON, YAML are like ice cream flavors.  We all have our preferences and complaints with them all.


was (Author: dsmiley):
I don't think changing the formats is worth the effort.  Formats like XML, JSON, YAML are like ice cream flavors.  We all have our preferences and complains with them all.

> Load elevate.xml in a more secure way
> -------------------------------------
>
>                 Key: SOLR-16296
>                 URL: https://issues.apache.org/jira/browse/SOLR-16296
>             Project: Solr
>          Issue Type: Improvement
>      Security Level: Public(Default Security Level. Issues are Public) 
>            Reporter: Haythem Khiri
>            Assignee: David Smiley
>            Priority: Minor
>
> Solr should ensure that most XML files in a ConfigSet should be loaded in an untrusted way for security. XML files can have custom DTDs and Xinclude for ConfigSets provided externally.
> This is not about changing how solrconfig.xml and schema.xml is being loaded.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org