This repository has been archived by the owner on Jul 22, 2024. It is now read-only.

xxe #172

Open

QiAnXinCodeSafe opened this issue Jul 18, 2019 · 2 comments

QiAnXinCodeSafe commented Jul 18, 2019

The xml external entity is not disabled when parsing the xml string. When analyzing malicious apk or app, it may cause xml external entity injection.

Contributor

borisf commented Jul 18, 2019

Any suggestions how to fix

Author

QiAnXinCodeSafe commented Jul 23, 2019 •

edited

Loading

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.