SEI CERT Oracle Coding Standard for Java

Space shortcuts

Page tree

Versions Compared

Old Version 116

changes.mady.by.user David Svoboda

Saved on

compared with

New Version 117

changes.mady.by.user David Svoboda

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Migrated to Confluence 4.0

...

An XML document can be dynamically constructed from smaller logical blocks called entities. Entities can be internal, external, or parameter-based. External entities allow the inclusion of XML data from external files.

Wiki MarkupAccording to XML W3C Recommendation \ [[W3C 2008|AA. References#W3C 08]\], Section 4.4.3, "Included If Validating":

When an XML processor recognizes a reference to a parsed entity, to validate the document, the processor MUST include its replacement text. If the entity is external, and the processor is not attempting to validate the XML document, the processor MAY, but need not, include the entity's replacement text.

...

CERT C Secure Coding Standard

STR02-C. Sanitize data passed to complex subsystems

CERT C++ Secure Coding Standard

STR02-CPP. Sanitize data passed to complex subsystems

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="637f2c01-1548-46e2-817a-0552a13b6102"><ac:plain-text-body><![CDATA[

[ISO/IEC TR 24772:2010

http://www.aitcnet.org/isai/]

Injection [RST]

]]></ac:plain-text-body></ac:structured-macro>

MITRE CWE

CWE-116. Improper encoding or escaping of output

Bibliography

ISO/IEC TR 24772:2010

Injection [RST]

MITRE CWE

CWE-116. Improper encoding or escaping of output

Bibliography

[OWASP 2005]

 

[OWASP 2007]

 

[OWASP 2008]

Testing for XML Injection (OWASP-DV-008)

[W3C 2008

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="edcc7ef7-0243-45e3-8d3b-04610219731b"><ac:plain-text-body><![CDATA[

[[OWASP 2005

AA. References#OWASP 05]]

 

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="62bb381b-bd8c-40eb-be49-0101e431cb87"><ac:plain-text-body><![CDATA[

[[OWASP 2007

AA. References#OWASP 07]]

 

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="e09f2263-d32c-4748-a672-0ebe71563fac"><ac:plain-text-body><![CDATA[

[[OWASP 2008

AA. References#OWASP 08]]

[Testing for XML Injection (OWASP-DV-008)

https://www.owasp.org/index.php/Testing_for_XML_Injection_%28OWASP-DV-008%29]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="6575445e-03ac-464a-a31d-d5dcb4aef4ea"><ac:plain-text-body><![CDATA[

[[W3C 2008

AA. References#W3C 08]]

4.4.3, Included If Validating ]]></ac:plain-text-body></ac:structured-macro>

...