Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=958047
Bug ID: 958047
Summary: woodstox-core:
javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING not
supported
Product: Fedora
Version: rawhide
Component: woodstox-core
Severity: unspecified
Priority: unspecified
Assignee: jcapik(a)redhat.com
Reporter: fweimer(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
jcapik(a)redhat.com, mizdebsk(a)redhat.com
Blocks: 958046
Category: ---
This doesn't work:
SAXParserFactory factory = new WstxSAXParserFactory();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
SAXParser parser = factory.newSAXParser();
InputSource is = new InputSource(new FileInputStream(args[0]));
parser.parse(is, new DefaultHandler());
It results in:
Exception in thread "main" org.xml.sax.SAXNotRecognizedException: Feature
'http://javax.xml.XMLConstants/feature/secure-processing' not recognized
As a result, it appears impossible to defend against "billion laughs"-style
denial of service attacks, along the lines of:
https://git.fedorahosted.org/cgit/secure-coding.git/tree/defensive-coding...
https://git.fedorahosted.org/cgit/secure-coding.git/tree/defensive-coding...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=bPCdHpPVN2&a=cc_unsubscribe