search

shlomif / perl-XML-LibXML

The XML-LibXML CPAN Distribution for Processing XML using the libxml2 library
https://metacpan.org/release/XML-LibXML
Other
17 stars 35 forks source link

XML::LibXML has by default enabled insecure http network access #43

Open pali opened 4 years ago

pali commented 4 years ago

XML::LibXML may be instructed to download some parts of XML even when expand_entities and load_ext_dtd are disabled as happened in https://github.com/shlomif/perl-XML-LibXML/pull/39

So network access which is enabled by default is still a security problem even after avoiding XXE.

Moreover https network access is not supported. Only http which is another security issue in network access.