validate
validate copied to clipboard
Investigate potential security concerns for not ignore DTD definitions in labels
From security scan:
PDS-000004 | 12/31/18 | Determine if the findings about the parsing of user-controlled XML documents is valid, and determine the potential consequences if they are. | med | preparation/pds4-tools/src/main/java/gov/nasa/pds/objectAccess/ObjectAccess.java | 163 | Resolving XML external entity in user-controlled data (CWE-611) | Resolving XML external entity in user-controlled data (CWE-611). Parsing user-controlled XML documents and allowing expansion of external entity references may lead to disclosure of confidential data or denial of service. | Y | More research needed, but this couldbe relevant. | CWE-611 | The best way to prevent XML External Entity attacks is if possible disable the parsing of any Document Type Declarations (DTDs) in untrusted data. Many XML parsers for Java are a know and easy target for exploitation. |
---|