https://ask.clojure.org/index.php/tag/xxe https://ask.clojure.org/index.php/13523/data-xml-disable-support-dtd-by-default <p>As defined by OWASP recommendations [1], both <code>supporting-external-entities</code> and <code>support-dtd</code> should be disabled by default.<br> While it's the case for the former (but not released as part of the 0.0.8 version), it's not the case for the latter.</p> <p>Can we consider having both defined to <code>false</code> as part of a stable version?</p> <p>[1] : <a rel="nofollow" href="https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser">https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser</a>.</p> data.xml https://ask.clojure.org/index.php/13523/data-xml-disable-support-dtd-by-default Mon, 04 Dec 2023 19:14:34 +0000