If you'll want to know more, many resources on the internet will provide you with the information you need. I'll briefly describe the essence of the problem.
CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion'). CWE-611: Improper Restriction of XML External Entity Reference. There are two main problems here: data disclosure and denial of service. What does incorrect processing mean? Often it's excessive trust to input data (a perpetual problem that causes many vulnerabilities) combined with XML parsers that lack sufficient limitations.Īs a result, if the files are compromised, this may cause various unpleasant consequences. It has to do with incorrect XML file processing that makes applications vulnerable to attacks. The fact is, one of the OWASP Top 10 categories we are developing diagnostic rules for, is A4:2017-XML External Entities (XXE). So, I created (or, to be exact, attempted to create) a sample project to test the analyzer. By the way, if you missed it, not too long ago we added the taint analysis feature. If we talk about the C# analyzer, the main focus here is OWASP (that's the latest version available - we are looking forward to an update!) support. We continue to actively develop PVS-Studio as a SAST solution. 
To do this, we'll need to understand why processing XML files carelessly can be dangerous and what the PVS-Studio analyzer has to do with all this.
Why create some weird XML and add it to projects?. Now go make yourself a cup of coffee, get back to your computer, and watch Visual Studio eat up more and more RAM.
0 kommentar(er)
