Roman Wagner
Roman Wagner
@oliverchang
@bhmohanr-techie thanks for your effort, but we highly suggest to use the whitelist approach in https://github.com/apache/commons-jxpath/pull/26. The main problem is that the default behaviour of the library is not changing....
If someone is interested in the rejected issue, have a look at https://github.com/Warxim/CVE-2022-41852. There is also some interesting discussion in https://github.com/apache/commons-jxpath/pull/26.
I've discovered similar issues when writing custom data-flow semantics for `strncat`.
@FilipJirsak we have client which is affected by the issue. Do you plan to fix the issue in the upcoming weeks?
The stacktrace does not seem to point to an issue in Openjdk javax.xml.parsers.DocumentBuilder parser. The issue is triggered by org.dom4j.io.DOMReader.read(), isn't it?
Does this mean that dom4j is not able to handle any malformed XML data by default and is out of responsibility here?