Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=958047
Bug ID: 958047 Summary: woodstox-core: javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING not supported Product: Fedora Version: rawhide Component: woodstox-core Severity: unspecified Priority: unspecified Assignee: jcapik@redhat.com Reporter: fweimer@redhat.com QA Contact: extras-qa@fedoraproject.org CC: java-sig-commits@lists.fedoraproject.org, jcapik@redhat.com, mizdebsk@redhat.com Blocks: 958046 Category: ---
This doesn't work:
SAXParserFactory factory = new WstxSAXParserFactory(); factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); SAXParser parser = factory.newSAXParser(); InputSource is = new InputSource(new FileInputStream(args[0])); parser.parse(is, new DefaultHandler());
It results in:
Exception in thread "main" org.xml.sax.SAXNotRecognizedException: Feature 'http://javax.xml.XMLConstants/feature/secure-processing' not recognized
As a result, it appears impossible to defend against "billion laughs"-style denial of service attacks, along the lines of:
https://git.fedorahosted.org/cgit/secure-coding.git/tree/defensive-coding/sr... https://git.fedorahosted.org/cgit/secure-coding.git/tree/defensive-coding/sr...
https://bugzilla.redhat.com/show_bug.cgi?id=958047
Mikolaj Izdebski mizdebsk@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1009415
https://bugzilla.redhat.com/show_bug.cgi?id=958047
Florian Weimer fweimer@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Version|20 |rawhide
https://bugzilla.redhat.com/show_bug.cgi?id=958047
Fedora Admin XMLRPC Client fedora-admin-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Assignee|jcapik@redhat.com |msimacek@redhat.com
--- Comment #2 from Fedora Admin XMLRPC Client fedora-admin-xmlrpc@redhat.com --- This package has changed ownership in the Fedora Package Database. Reassigning to the new owner of this component.
https://bugzilla.redhat.com/show_bug.cgi?id=958047
Fedora End Of Life jkurik@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL Last Closed| |2016-07-19 06:11:18
--- Comment #4 from Fedora End Of Life jkurik@fedoraproject.org --- Fedora 22 changed to end-of-life (EOL) status on 2016-07-19. Fedora 22 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug.
If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug.
Thank you for reporting this bug and we are sorry it could not be fixed.
java-sig-commits@lists.fedoraproject.org