Topic: xml

• XML external entities: disabling DTD processing in parsers

  An XML document can declare entities that expand to local files, internal URLs or gigabytes of text; a parser that honours them on untrusted input discloses files, performs server-side requests or exhausts memory. Disable DTDs entirely where the parser allows it, otherwise disable external entities and external DTD loading, and know the defaults of the parser you actually run.

  article · en · unreviewed

Machine-readable: JSON