Lukasz Lenart 620fcbd152 WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks (#1642) ...

Modern JDKs (7u45+) already protect against this attack with a built-in
64K entity expansion limit. These changes add defense-in-depth hardening
and remove unnecessary attack surface.

- Remove unused parseStringAsXML feature from StringAdapter to eliminate
  a theoretical XML Entity Expansion vector
- Deprecate setParseStringAsXML() and getParseStringAsXML() for removal
- Enable SECURE_PROCESSING feature in DigesterDefinitionsReader
- Add unit test verifying JDK's entity expansion limit rejects
  Billion Laughs payloads
- Add research document with vulnerability analysis

Co-authored-by: Claude <noreply@anthropic.com>

2026-04-04 11:20:33 +02:00

..

plans

WW-5444 Add HTML5 theme with comprehensive unit tests (#1422)

2025-12-14 19:24:05 +01:00

prs

Improve Claude Code agents configuration for Apache Struts

2025-09-29 11:57:42 +02:00

research

WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks (#1642)

2026-04-04 11:20:33 +02:00

tickets

Improve Claude Code agents configuration for Apache Struts

2025-09-29 11:57:42 +02:00

validation

WW-5514 Add StrutsProxyService for proxy detection and resolution (#1586)

2026-02-21 18:18:08 +01:00

.gitkeep

Improve Claude Code agents configuration for Apache Struts

2025-09-29 11:57:42 +02:00