[XERCESC-2178] Missing XML Validation (Veracode)

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Invalid
• Affects Version/s: 2.8.0
• Component/s: Non-Validating Parser
• Labels: Veracode abstractdomparser
• Environment: AbstractDOMParser - Line 108.
• Assignee: Unassigned
• Reporter: cw_dev
• Created: 08/Oct/19 12:33
• Updated: 09/Dec/19 17:39
• Resolved: 09/Dec/19 17:39

Description

Veracode flaw:

By explicitly disabling XML validation, the application is making an assumption that the data provided will conform to the expected format. This can be dangerous if the parser does not properly handle malformed data.

Recommendations:
Validate all XML data against a DTD schema to prevent an attacker from providing malicious or otherwise unexpected
input.