[jira] [Updated] (OFBIZ-12925) [codeQL] Resolving specific Java issues

["Jacques Le Roux (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/OFBIZ-12925?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Jacques Le Roux updated OFBIZ-12925:
------------------------------------
    Summary: [codeQL]  Resolving specific Java issues  (was: [codeQL]  Resolving XML external entity in user-controlled data)

> [codeQL]  Resolving specific Java issues
> ----------------------------------------
>
>                 Key: OFBIZ-12925
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-12925
>             Project: OFBiz
>          Issue Type: Sub-task
>          Components: accounting, framework/base
>    Affects Versions: Upcoming Branch
>            Reporter: Jacques Le Roux
>            Assignee: Jacques Le Roux
>            Priority: Major
>             Fix For: Upcoming Branch
>
>
> codeQL reports 3 such issues:
> Parsing untrusted XML files with a weakly configured XML parser may lead to an XML External Entity (XXE) attack. This type of attack uses external entity references to access arbitrary files on a system, carry out denial of service, or server side request forgery. Even when the result of parsing is not returned to the user, out-of-band data retrieval techniques may allow attackers to steal sensitive data. Denial of services can also be carried out in this situation.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)