Return-Path: X-Original-To: apmail-db-derby-dev-archive@www.apache.org Delivered-To: apmail-db-derby-dev-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 6EB0D1855A for ; Wed, 17 Jun 2015 23:53:01 +0000 (UTC) Received: (qmail 45920 invoked by uid 500); 17 Jun 2015 23:53:01 -0000 Delivered-To: apmail-db-derby-dev-archive@db.apache.org Received: (qmail 45900 invoked by uid 500); 17 Jun 2015 23:53:01 -0000 Mailing-List: contact derby-dev-help@db.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: Delivered-To: mailing list derby-dev@db.apache.org Received: (qmail 45886 invoked by uid 99); 17 Jun 2015 23:53:01 -0000 Received: from arcas.apache.org (HELO arcas.apache.org) (140.211.11.28) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 17 Jun 2015 23:53:01 +0000 Date: Wed, 17 Jun 2015 23:53:01 +0000 (UTC) From: "Bryan Pendleton (JIRA)" To: derby-dev@db.apache.org Message-ID: In-Reply-To: References: Subject: [jira] [Commented] (DERBY-6810) Add regression tests for XXE vulnerability MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394 [ https://issues.apache.org/jira/browse/DERBY-6810?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14590877#comment-14590877 ] Bryan Pendleton commented on DERBY-6810: ---------------------------------------- I tried several experimental changes to SqlXmlUtil: 1 dBF.setExpandEntityReferences(false); 2 dBF.setFeature( XMLConstants.ACCESS_EXTERNAL_DTD, false ); 3 dBF.setAttribute( "http://apache.org/xml/features/disallow-doctype-decl", false ); Number (1) and number (3) had no effect on the file access behavior of XMLXXETest.testDerby6807FileAccess() Number (2) didn't even compile in my environment. > Add regression tests for XXE vulnerability > ------------------------------------------ > > Key: DERBY-6810 > URL: https://issues.apache.org/jira/browse/DERBY-6810 > Project: Derby > Issue Type: Sub-task > Reporter: Bryan Pendleton > Assignee: Abhinav Gupta > Attachments: billionLaughs.diff, readPasswordFile.diff > > > We should add some regression tests demonstrating that > Derby is no longer vulnerable to an XXE assault. > One possibility would be to have a example using a local > file disclosure. > Another possibility would be to have example based on the > well-known "Billion Laughs" denial of service attack. -- This message was sent by Atlassian JIRA (v6.3.4#6332)