You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2021/11/25 09:04:59 UTC

[Bug 65704] New: The class XmlUtil.java have XXE security issue

https://bz.apache.org/bugzilla/show_bug.cgi?id=65704

            Bug ID: 65704
           Summary: The class XmlUtil.java have XXE security issue
           Product: Taglibs
           Version: 1.2.5
          Hardware: PC
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Unknown Taglib
          Assignee: dev@tomcat.apache.org
          Reporter: powercomtlmt@huawei.com
  Target Milestone: ---

Created attachment 38102
  --> https://bz.apache.org/bugzilla/attachment.cgi?id=38102&action=edit
source code

At the line 88, XML parser configured 'tf' does not prevent nor limit external
entities resolution. This can expose the parser to an XML External Entities
attack.Using XML parsers configured to not prevent nor limit external entities
resolution can expose the parser to an XML External Entities attack. For
example as below:

 tf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

i think taglibs can add the above content first and parse the xml on next step,
it will be better. Thanks

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

[Bug 65704] The class XmlUtil.java have XXE security issue

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65704

Mark Thomas <ma...@apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
                 OS|                            |All
         Resolution|---                         |INVALID

--- Comment #1 from Mark Thomas <ma...@apache.org> ---
1. Security reports should not be posted to public bug trackers or mailing
lists. The correct way to report security issues is described here:
http://tomcat.apache.org/security.html

2. The parser is not exposed to untrusted user input. It is not exploitable.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org