New answers tagged validation
The way we decided to address XML expansion and XXE vulnerabilities is to search for the !ENTITY and !DOCTYPE substring in the XML. If they exist, the XML was sent by an attacker because they are not sent by the application. We also decided to count < and > in order to protect from an attack like @Bruno Rohée suggested and only parse the document if ...
for XXE please read: http://www.ubercomp.com/posts/2014-01-16_facebook_remote_code_execution http://blog.h3xstream.com/2014/06/identifying-xml-external-entity.html i can confirm a similar attack worked on Java/Tomcat And then there is a Billion Laugh - Attack ( i think this was what Bruno referred to) http://en.wikipedia.org/wiki/Billion_laughs
Top 50 recent answers are included