Copilot commented on code in PR #127: URL: https://github.com/apache/xerces-j/pull/127#discussion_r4493501808
########## SECURITY.md: ########## @@ -0,0 +1,38 @@ +# Security Policy + +Apache Xerces Java is a mid-level library. +It is generally not intended for direct use by end users. However, its core +functions do include parsing and validating potentially malicious documents +supplied by untrusted users. It is critical that Xerces does this correctly +according to spec regardless of input. +When faced with hostile input, it should report the problem without +crashing or failing. +It is safe to provide possibly malicious external input to Xerces unless otherwise specified. Review Comment: This blanket safety assurance is misleading because the policy explicitly permits external entity and DTD loading on line 26. With external-resource resolution enabled, untrusted XML can cause local-file reads or network requests without any parser defect. Qualify the assurance with the configuration precautions required for untrusted input. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
