File tree Expand file tree Collapse file tree 2 files changed +3
-3
lines changed
cpp/ql/src/Security/CWE/CWE-611 Expand file tree Collapse file tree 2 files changed +3
-3
lines changed Original file line number Diff line number Diff line change 44<overview >
55<p >
66Parsing untrusted XML files with a weakly configured XML parser may lead to an
7- XML External Entity (XXE) attack. This type of attack uses external entity references
7+ XML external entity (XXE) attack. This type of attack uses external entity references
88to access arbitrary files on a system, carry out denial-of-service (DoS) attacks, or server-side
99request forgery. Even when the result of parsing is not returned to the user, DoS attacks are still possible
1010and out-of-band data retrieval techniques may allow attackers to steal sensitive data.
Original file line number Diff line number Diff line change 11/**
2- * @name External Entity Expansion
2+ * @name XML external entity expansion
33 * @description Parsing user-controlled XML documents and allowing expansion of
44 * external entity references may lead to disclosure of
55 * confidential data or denial of service.
@@ -208,5 +208,5 @@ class XXEConfiguration extends DataFlow::Configuration {
208208from XXEConfiguration conf , DataFlow:: PathNode source , DataFlow:: PathNode sink
209209where conf .hasFlowPath ( source , sink )
210210select sink , source , sink ,
211- "This $@ is not configured to prevent an External Entity Expansion (XXE) attack." , source ,
211+ "This $@ is not configured to prevent an XML external entity (XXE) attack." , source ,
212212 "XML parser"
You can’t perform that action at this time.
0 commit comments