xml - Java SAX parser, How do I prevent character references entirely? (DoS attack) -

-

the xml files of incoming request needs validated. 1 requierement character references prevented entirely because of possible dos attacks. if configure saxparserfactory below:

saxparserfactory spf = saxparserfactory.newinstance(); spf.setfeature(xmlconstants.feature_secure_processing, true);

then parer still resolves 100.000 entity expansions.

the parser has encountered more "100.000" entity expansions in document; limit imposed application.

the prevention of external references done via entityresolver works fine. how prevent character references?

character references cannot cause denial of service attack, there no reason prevent them.


Comments

Post a Comment

Popular posts from this blog

Unable to remove the www from url on https using .htaccess -

-
i want remove www site url. ie. https://www.domainname.com.au https://domainname.com.au . i have tried various .htacces code nothing work me. here present code remove www http not work https. rewriteengine on rewritebase / rewritecond %{http_host} ^www\.(.*)$ [nc] rewriterule ^/(.*)$ http://%1/$1 [r=301,l] rewritecond %{https} off rewriterule ^(.*)$ https://domainname.com.au/$1 [r=301,l] rewriterule ^code-of-conducts/(.*)/$ code-of-conducts.php?type=$1 rewriterule ^parents/post-a-job/(.*)/edit/$ parents/post-a-job.php?action=edit&id=$1 rewriterule ^parents/post-a-job/(.*)/$ parents/post-a-job.php?job_type=$1 rewriterule ^parents/open-jobs/(.*)/delete/$ parents/open-jobs.php?action=delete&id=$1 rewriterule ^parent-profile/(.*)/$ parent-profile.php?id=$1 rewriterule ^parents/job-details/(.*)$ parents/job-details.php?applied_id=$1 rewriterule ^sitterprofile/(.*)/$ sitterprofile.php?id=$1 rewriterule ^sitter/job-board/state/(.*)/page/(.*)/$ sitter/job-board.ph...
Read more