deegree/deegree3 — pull request #25 by copierrj (2013-01-10 10:01:38+00:00)
Title: DTD Entities

By default StAX supports parsing of DTD Entities. This feature can be easily abused.

See:

* http://cwe.mitre.org/data/definitions/611.html
* http://cwe.mitre.org/data/definitions/776.html

In this pull requests I suggest to change the behavior of deegree3 in the following manner:

While parsing xml from an untrusted origin (i.e. part of external requests) the StAX features:

* javax.xml.stream.isReplacingEntityReferences
* javax.xml.stream.isSupportingExternalEntities

should be disabled.

Of course there could be legitimate use of those features. Unfortunately it is far from trivial to solve the issues caused by them any other way.

We could consider introducing a configuration parameter for this somewhere in the workspace. But in my opinion enabling these features is almost never a good idea as long as there is no other solution in place to solve mentioned issues.