apache / drill

Apache Drill is a distributed MPP query layer for self describing data

https://drill.apache.org/

Apache License 2.0

1.93k stars 984 forks source link

DRILL-8461: Prevent XXE Attacks in XML Format Plugin #2845

Closed cgivre closed 8 months ago

cgivre commented 8 months ago

DRILL-8461: Prevent XXE Attacks in XML Format Plugin

Description

Drill's XML reader would allow a maliciously crafted XML file to perform an XML eXternal Entity injection (XXE) attack. This fix disables DTD parsing in the XML format plugin and prevents XXE attacks.

Documentation

No user facing changes.

Testing

Added unit test and tested manually.