Skip to content

Commit

Permalink
Update rule metadata (#1079)
Browse files Browse the repository at this point in the history
  • Loading branch information
andrea-guarino-sonarsource authored Feb 7, 2022
1 parent dd5ff1a commit 00c4683
Show file tree
Hide file tree
Showing 2 changed files with 1 addition and 14 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -3,19 +3,6 @@
<p>When parsing the XML file, the content of the external entities is retrieved from an external storage such as the file system or network, which may
lead, if no restrictions are put in place, to arbitrary file disclosures or <a
href="https://www.owasp.org/index.php/Server_Side_Request_Forgery">server-side request forgery (SSRF)</a> vulnerabilities.</p>
<pre>
&lt;?xml version="1.0" encoding="utf-8"?&gt;
&lt;!DOCTYPE person [
&lt;!ENTITY file SYSTEM "file:///etc/passwd"&gt;
&lt;!ENTITY ssrf SYSTEM "https://internal.network/sensitive_information"&gt;
]&gt;

&lt;person&gt;
&lt;name&gt;&amp;file;&lt;/name&gt;
&lt;city&gt;&amp;ssrf;&lt;/city&gt;
&lt;age&gt;18&lt;/age&gt;
&lt;/person&gt;
</pre>
<p>It’s recommended to limit resolution of external entities by using one of these solutions:</p>
<ul>
<li> If DOCTYPE is not necessary, completely disable all DOCTYPE declarations. </li>
Expand Down
2 changes: 1 addition & 1 deletion sonarpedia.json
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"languages": [
"PY"
],
"latest-update": "2022-01-10T15:34:41.492970Z",
"latest-update": "2022-02-07T13:04:10.465499Z",
"options": {
"no-language-in-filenames": true,
"preserve-filenames": true
Expand Down

0 comments on commit 00c4683

Please sign in to comment.