[xmltv] Avoid XXE injection #15467
Merged
[xmltv] Avoid XXE injection #15467
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
XMLInputFactory: Disable property IS_SUPPORTING_EXTERNAL_ENTITIES which allows injecting external entities. Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>
|
@clinique : any feedback ? |
|
@holgerfriedrich : sorry for late review of your proposal. Thanks for this. |
lolodomo
added
the
enhancement
lolodomo
changed the title
Pshatsillo
pushed a commit
to Pshatsillo/openhab-addons
that referenced
this pull request
Sep 29, 2023
XMLInputFactory: Disable property IS_SUPPORTING_EXTERNAL_ENTITIES which allows injecting external entities. Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>
pat-git023
pushed a commit
to pat-git023/openhab-addons
that referenced
this pull request
Oct 13, 2023
XMLInputFactory: Disable property IS_SUPPORTING_EXTERNAL_ENTITIES which allows injecting external entities. Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>
querdenker2k
pushed a commit
to querdenker2k/openhab-addons
that referenced
this pull request
Oct 21, 2023
XMLInputFactory: Disable property IS_SUPPORTING_EXTERNAL_ENTITIES which allows injecting external entities. Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>
querdenker2k
pushed a commit
to querdenker2k/openhab-addons
that referenced
this pull request
Oct 29, 2023
XMLInputFactory: Disable property IS_SUPPORTING_EXTERNAL_ENTITIES which allows injecting external entities. Signed-off-by: Holger Friedrich <mail@holger-friedrich.de> Signed-off-by: querdenker2k <querdenker2k@gmx.de>
austvik
pushed a commit
to austvik/openhab-addons
that referenced
this pull request
Mar 27, 2024
XMLInputFactory: Disable property IS_SUPPORTING_EXTERNAL_ENTITIES which allows injecting external entities. Signed-off-by: Holger Friedrich <mail@holger-friedrich.de> Signed-off-by: Jørgen Austvik <jaustvik@acm.org>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
XMLInputFactory: Disable property IS_SUPPORTING_EXTERNAL_ENTITIES which allows injecting external entities.
I cannot test this change. @clinique was it intentional to disable DTD and keep external entities on?
In case, please close my PR.