Lists Home |
Date Index |
Rick Jelliffe wrote,
> It strikes me that this puts the cart before the horse. The answer
> is not to ban external entities, it is to allow access control lists
> as part of entity managers or URL resolvers.
Sure, but isn't that tantamount to agreeing with,
Most XML parsers allow their user to explicitly specify external
entity handler. In case of untrusted XML input it is best to prohibit
all external general entities.
because your ACL will effectively be whitelisting your *trusted*