Bug 1382321 - Mention danger of XXE attack if some resteasy parameters are set to non default values
Summary: Mention danger of XXE attack if some resteasy parameters are set to non defau...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: JBoss Enterprise Application Platform 6
Classification: JBoss
Component: Documentation
Version: 6.4.10
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
: ---
Assignee: sgilda
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-10-06 11:07 UTC by Katerina Odabasi
Modified: 2017-05-02 12:26 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-05-02 12:25:05 UTC
Type: Bug

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Katerina Odabasi 2016-10-06 11:07:42 UTC 
Document URL: 
https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6.4/html-single/Development_Guide/index.html#sect-JAX-RS_Web_Service_Security

Section Number and Name: 
15.6. JAX-RS Web Service Security

Describe the issue: 
Resteasy has three parameters which are protection against XML external entity attack.
These parameters are have default values set in a way that resteasy is protected against it.

This chapter shoul contain warning that changing default values of these three parameters may cause REST application to be potentially vulnerable against XXE attack.

The mentioned parameters are:

    resteasy.document.expand.entity.references
    resteasy.document.secure.processing.feature
    resteasy.document.secure.disableDTDs
    (all documented in A.2. RESTEasy Configuration Parameters chapter)


Suggestions for improvement: 

Additional information:
Comment 1 sgilda 2017-01-05 20:11:44 UTC 
@nchauda fixed this for 7.1. I will apply the same fix to 6.4.
Comment 6 sgilda 2017-02-15 16:41:28 UTC 
This update is to the Development Guide.
Comment 7 sgilda 2017-02-17 00:12:43 UTC 
Content is updated on the portal here: https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6.4/html-single/Development_Guide/index.html#Enable_Role-Based_Security_for_a_RESTEasy_JAX-RS_Web_Service
Note You need to log in before you can comment on or make changes to this bug.