search

OpenConext / Stepup-tiqr

tiqr IdP for step-up authentication
Apache License 2.0
3 stars 2 forks source link

Prevent XXE in SPController #68

Closed MKodde closed 5 years ago

MKodde commented 5 years ago

By disabling the entity loader, we prevent possible XXE exploitations. After disabling the loader, the previous state is reset.

MKodde commented 5 years ago

https://www.pivotaltracker.com/story/show/161177401