Comment 13 for bug 1025185
Revision history for this message
| Nicolas Grégoire (nicolas-gregoire) wrote | #13 |
© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
4d1350f
(Get the code!)
The best way to configure the parser (but this would need some functional testing) would imho be:
- without XML_PARSE_NOENT ("Substitute entities")
- without XML_PARSE_XINCLUDE ("Implement XInclude substitution")
- without XML_PARSE_DTDLOAD ("load the external subset")
- with XML_PARSE_NONET ("Forbid network access")
For your information, here's the patch that XML::Atom applied regarding CVE-2012-1102:
http://