mirror of https://github.com/apache/struts.git synced 2026-08-05 06:36:58 +00:00

Files

T

History

Lukasz Lenart 620fcbd152 WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks (#1642 )

Modern JDKs (7u45+) already protect against this attack with a built-in
64K entity expansion limit. These changes add defense-in-depth hardening
and remove unnecessary attack surface.

- Remove unused parseStringAsXML feature from StringAdapter to eliminate
  a theoretical XML Entity Expansion vector
- Deprecate setParseStringAsXML() and getParseStringAsXML() for removal
- Enable SECURE_PROCESSING feature in DigesterDefinitionsReader
- Add unit test verifying JDK's entity expansion limit rejects
  Billion Laughs payloads
- Add research document with vulnerability analysis

Co-authored-by: Claude <noreply@anthropic.com>

2026-04-04 11:20:33 +02:00

global

Improve Claude Code agents configuration for Apache Struts

2025-09-29 11:57:42 +02:00

lukaszlenart

Add tests for conversion error repopulation with indexed properties (#1391 )

2025-10-18 12:45:18 +02:00

searchable

Improve Claude Code agents configuration for Apache Struts

2025-09-29 11:57:42 +02:00

shared

WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks (#1642 )

2026-04-04 11:20:33 +02:00

README.md

Improve Claude Code agents configuration for Apache Struts

2025-09-29 11:57:42 +02:00

README.md

Thoughts Directory Structure

This directory structure supports Claude Code research and documentation workflows.

Directory Structure

shared/ - Team-shared documents and research
$USER/ - User-specific personal notes and drafts
global/ - Cross-repository documentation
searchable/ - Search index for all thoughts (managed automatically)

Usage

The Claude Code agents use this structure to organize research findings, ticket analysis, and architectural documentation for the Apache Struts project.