Uploaded image for project: 'XWiki Commons'
  1. XWiki Commons
  2. XCOMMONS-2570

XMLUtils.parse() doesn't support entities

    XMLWordPrintable

Details

    • Bug
    • Resolution: Unresolved
    • Major
    • None
    • 13.10
    • XML
    • None
    • Unknown

    Description

      Example input to parse:

              String xml = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"
            + "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\"\n"
            + "   \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\">\n"
            + "\n"
            + "<p>&dollar;</p>";

      Currently, when parsed, the paragraph tag content is empty.

      The way to solve this without introducing an XXE attack is by having a custom resolver similar to the one we copied from xml-dtd.

      Attachments

        Activity

          People

            Unassigned Unassigned
            vmassol Vincent Massol
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated: