Modify

Opened 3 years ago

Closed 3 years ago

Last modified 3 years ago

#19286 closed defect (fixed)

[PATCH] External entities are resolved when parsing tagging presets

Reported by: hiddewie Owned by: team
Priority: normal Milestone: 20.06
Component: Core Version:
Keywords: security external Cc:

Description

This problem can cause a security vulnerability if users use tagging presets from an untrusted source.

By having a preset installed that references an XML external entity, information from the local system may be disclosed. Also see https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing and https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html.

Also added some tests for the other (safe) XML utility methods that already worked safely.

Attachments (1)

Change History (3)

comment:1 Changed 3 years ago by simon04

Resolution: fixed
Status: newclosed

In 16560/josm:

fix #19286 - External entities are resolved when parsing tagging presets (patch by hiddewie, modified)

comment:2 Changed 3 years ago by simon04

Keywords: security external added
Milestone: 20.06

Modify Ticket

Change Properties
Set your email in Preferences
Action
as closed The owner will remain team.
as The resolution will be set.
The resolution will be deleted.

Add Comment


E-mail address and name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.