Added more mitigations for XXE

2017-06-15 23:36:51 +02:00 · 2017-06-15 23:36:51 +02:00 · 36ad73c800
commit 36ad73c800
parent e9ad20cb30
1 changed files with 8 additions and 0 deletions
--- a/webgoat-lessons/xxe/src/main/resources/lessonPlans/en/XXE_mitigation.adoc
+++ b/webgoat-lessons/xxe/src/main/resources/lessonPlans/en/XXE_mitigation.adoc
@ -19,3 +19,11 @@ xif.setProperty(XMLInputFactory.SUPPORT_DTD, true);
 ----

 For more information about configuration, see https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet
+
+
+==== Validate
+
+Implement proper validation for the Content-type and Accept header do not simply rely on the framework to handle
+ the incoming request. Also if the client specifies a proper accept header return with a `406/Not Acceptable.
+
+`