Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Disable XML entities by default against XXE in Lucee 6.0 & 5.4

Description

Lucee should be secure by default

to override for a specific use case with trusted xml, you can do the following

application action="update" xmlFeatures={ "externalGeneralEntities": true, "secure": false, "disallowDoctypeDecl": false }; xml = xmlParse( trustedXml ); application action="update" xmlFeatures={ "externalGeneralEntities": false, "secure": true, "disallowDoctypeDecl": true };

Activity

Show:

Pothys - MitrahSoft 28 July 2023 at 11:17

I checked this ticket with lucee latest version 6.0.0.523-SNAPSHOT and 5.4.2.20-SNAPSHOT. Now XML entities are successfully disabled by default.

Zac Spitzer 19 July 2023 at 09:02

Zac Spitzer 19 July 2023 at 07:53

Zac Spitzer 18 July 2023 at 20:59

Still need to add back in the passthru of other directives

Zac Spitzer 18 July 2023 at 16:39

We have decided that to also backport this to 5.4

Fixed

Details

Assignee

Reporter

Labels

New Issue warning screen

Before you create a new Issue, please post to the mailing list first https://dev.lucee.org

Once the issue has been verified, one of the Lucee team will ask you to file an issue

Sprint

Fix versions

Priority

Parent

Created 13 April 2021 at 19:06
Updated 28 July 2023 at 11:17
Resolved 28 July 2023 at 11:17