News for hackers. Stuff that matters.

A comment on OpenAPI v3.1 and JSON Schema 2019-09. Parent comment

Re:OpenAPI v3.1 and JSON Schema 2019-09 by dfox on Saturday February 29, 2020 @08:47PM (#22454550)
Obviously there aren't similar issues with parsing JSON. On the other hand if you ingest XML you simply don't want to use full implementation of validating XML parser, because making that work is bunch of pointless busywork. And these vulnerabilities are only relevant for validating XML parsers.
[ Parent | on HN ]
Re:OpenAPI v3.1 and JSON Schema 2019-09 by TedDoesntTalk on Sunday March 01, 2020 @04:10AM (#22455955)
xml entity expansion has nothing to do with XML validation and is an attack vector no matter if you validate the xml doc or not.
[ Parent | on HN ]