[Bug 63899] xxe vulnerability

2021-09-07 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=63899 --- Comment #6 from PJ Fanning --- If you want to prevent the DTD being read at all, try this: final String FEATURE_LOAD_DTD_GRAMMAR = "http://apache.org/xml/features/nonvalidating/load-dtd-grammar";; final String FEATURE_LOAD_EXTERNAL_DTD = "

[Bug 63899] xxe vulnerability

2021-09-06 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=63899 --- Comment #5 from PJ Fanning --- One option is to use this: org.apache.poi.ooxml.POIXMLTypeLoader.DEFAULT_XML_OPTIONS.setLoadExternalDTD(false); -- You are receiving this mail because: You are the assignee for the bug.

[Bug 63899] xxe vulnerability

2019-11-16 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=63899 Dominik Stadler changed: What|Removed |Added Resolution|--- |INVALID Status|NEEDINFO

[Bug 63899] xxe vulnerability

2019-11-01 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=63899 --- Comment #4 from Santosh Pandey --- You can delete this bug -- You are receiving this mail because: You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubsc

[Bug 63899] xxe vulnerability

2019-11-01 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=63899 --- Comment #3 from Santosh Pandey --- Ok Sorry, sending issue on email list, closing this here -- You are receiving this mail because: You are the assignee for the bug. - To

[Bug 63899] xxe vulnerability

2019-11-01 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=63899 Dominik Stadler changed: What|Removed |Added Status|NEW |NEEDINFO --- Comment #2 from Dominik

[Bug 63899] xxe vulnerability

2019-11-01 Thread bugzilla
https://bz.apache.org/bugzilla/show_bug.cgi?id=63899 --- Comment #1 from PJ Fanning --- That DTD is benign. If you use XSSFWorkbook, XMLBeans is used to load the sharedstrings.xml. XMLBeans can be configured to control some of the XML Parser behaviours (org.apache.poi.ooxml.POIXMLTypeLoader.DEF