[
https://issues.apache.org/jira/browse/RAT-560?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18093619#comment-18093619
]
ASF subversion and git services commented on RAT-560:
-----------------------------------------------------
Commit 8f1322a3dd2444e442ce0f2108255c951b885ed5 in creadur-rat's branch
refs/heads/master from P. Ottlinger
[ https://gitbox.apache.org/repos/asf?p=creadur-rat.git;h=8f1322a3 ]
RAT-560, RAT-558: Fix XXE warning (#694)
* RAT-560, RAT-558: Fix XXE warning while processing provided stylesheets via
StandardXmlFactory
> Static analysis shows XXE attack vectors - streamline usage in RAT and add
> documentation
> ----------------------------------------------------------------------------------------
>
> Key: RAT-560
> URL: https://issues.apache.org/jira/browse/RAT-560
> Project: Apache RAT
> Issue Type: Task
> Components: core engine
> Affects Versions: 0.18
> Reporter: Philipp Ottlinger
> Assignee: Claude Warren
> Priority: Major
> Fix For: 1.0.0
>
>
> Static code analysis warns that XML parsers used in RAT are
> vulnerable/potentially vulnerable to XXE attacks:
> * Reporter.java:99/140
> * XMLConfigurationReader:156/175
> As RAT runs on customer-owned data and allows custom configuration the usage
> in the code should be streamlined and documented.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
