2 ms·
Obviously there aren't similar issues with parsing JSON. On the other hand if you ingest XML you simply don't want to use full implementation of validating XML
by dfox 7y ago
Obviously there aren't similar issues with parsing JSON. On the other hand if you ingest XML you simply don't want to use full implementation of validating XML parser, because making that work is bunch of pointless busywork. And these vulnerabilities are only relevant for validating XML parsers.
- TedDoesntTalk 7y agoxml entity expansion has nothing to do with XML validation and is an attack vector no matter if you validate the xml doc or not.