validate icon indicating copy to clipboard operation
validate copied to clipboard

Investigate potential security concerns for not ignore DTD definitions in labels

Open jordanpadams opened this issue 5 years ago • 0 comments

From security scan:

PDS-000004 12/31/18 Determine if the findings about the parsing of user-controlled XML documents is valid, and determine the potential consequences if they are. med preparation/pds4-tools/src/main/java/gov/nasa/pds/objectAccess/ObjectAccess.java 163 Resolving XML external entity in user-controlled data (CWE-611) Resolving XML external entity in user-controlled data (CWE-611).  Parsing user-controlled XML documents and allowing expansion of external entity references may lead to disclosure of confidential data or denial of service. Y More research needed, but this couldbe relevant.     CWE-611 The best way to prevent XML External Entity attacks is if possible disable the parsing of any Document Type Declarations (DTDs) in untrusted data. Many XML parsers for Java are a know and easy target for exploitation.

jordanpadams avatar Oct 17 '19 08:10 jordanpadams