You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by "sahvx655-wq (via GitHub)" <gi...@apache.org> on 2026/05/29 06:07:22 UTC
[PR] Xxe protection servlets hardening [tomcat]
sahvx655-wq opened a new pull request, #1015:
URL: https://github.com/apache/tomcat/pull/1015
Enable secure JAXP processing in DefaultServlet and WebdavServlet as defense-in-depth against XXE attacks.
Changes
Enabled FEATURE_SECURE_PROCESSING on TransformerFactory in DefaultServlet
Enabled FEATURE_SECURE_PROCESSING and disallowed DTDs on DocumentBuilderFactory in WebdavServlet
These changes strengthen XML parser security and align with JAXP best practices.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Xxe protection servlets hardening [tomcat]
Posted by "markt-asf (via GitHub)" <gi...@apache.org>.
markt-asf closed pull request #1015: Xxe protection servlets hardening
URL: https://github.com/apache/tomcat/pull/1015
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Xxe protection servlets hardening [tomcat]
Posted by "markt-asf (via GitHub)" <gi...@apache.org>.
markt-asf commented on PR #1015:
URL: https://github.com/apache/tomcat/pull/1015#issuecomment-4624038888
This PR a) is unnecessary b) breaks stuff.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org