3 ms·
XInclude is just like XML External Entities in that it never should have existed because of the glaring security issues. Worse is that it seems most XML parser
by Sohcahtoa82 3y ago
XInclude is just like XML External Entities in that it never should have existed because of the glaring security issues.
Worse is that it seems most XML parsers have XXE's enabled by default.
- bawolff 3y agoI think XXE would have been fine if it followed the same rules as ajax does in web browsers. Although i guess it is a glaring example of xml not being sure what level of abstraction its trying to be. The real wtf is recursive entity expansion (billion laughs)