search

liyiorg / weixin-popular

微信SDK JAVA (公众平台、开放平台、 商户平台、 服务商平台)
Apache License 2.0
2.5k stars 1.06k forks source link

XXE漏洞修复 #183

Closed fatphone closed 5 years ago

fatphone commented 5 years ago

xml通用类中的convertToObject 方法仍存在XXE漏洞 参考 https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#JAXB_Unmarshaller 进行修复