dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added more mitigations for XXE

Browse Source
This commit is contained in:
Nanne Baars 2017-06-15 23:36:51 +02:00
parent e9ad20cb30
commit 36ad73c800
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
webgoat-lessons/xxe/src/main/resources/lessonPlans/en/XXE_mitigation.adoc
View File

@ -19,3 +19,11 @@ xif.setProperty(XMLInputFactory.SUPPORT_DTD, true);
---- ----
For more information about configuration, see https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet For more information about configuration, see https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet
==== Validate
Implement proper validation for the Content-type and Accept header do not simply rely on the framework to handle
the incoming request. Also if the client specifies a proper accept header return with a `406/Not Acceptable.
`