Added Test for XXE #710

DotDotSlashRepo · 2021-01-12T17:55:39Z

This PR covers issue #8

This PR handles the issue and requires no additional PRs. Refer TODOs
You have validated the need for this change.

What did this PR accomplish?

Added test case for XXE

TODO

Edit top level page to link to test case.
This test case has overlap with WSTG-INPV-07 , XML injection. WSTG-INPV-07 is to be modified to eliminate duplication.
Need to re-order test case, XXE makes more sense to be after XML injection

Thank you for your contribution!

Added XXE test case.

fixed typos and enhanced content

lint corrections

fixed typo

...Web_Application_Security_Testing/07-Input_Validation_Testing/20-Testing_for_XXE_Injection.md

…n_Testing/20-Testing_for_XXE_Injection.md Co-authored-by: Rick M <[email protected]>

github-actions · 2021-02-05T18:21:20Z

Following links are broken:
FILE:document/4-Web_Application_Security_Testing/07-Input_Validation_Testing/20-Testing_for_XXE_Injection.md
[✖] https://www.securityfocus.com/archive/1/297714 → Status: 0

…n_Testing/20-Testing_for_XXE_Injection.md Co-authored-by: Rick M <[email protected]>

DotDotSlashRepo · 2021-02-05T18:34:08Z

TODO

Edit top level page to link to test case.
This test case has overlap with WSTG-INPV-07 , XML injection. WSTG-INPV-07 is to be modified to eliminate duplication.
Need to re-order test case, XXE makes more sense to be after XML injection

@kingthorin : Can I go ahead with these ?

kingthorin · 2021-02-05T18:46:11Z

I'm good with you addressing duplicate content.
However re-ordering things should wait until we are headed to 5.x. Currently we are still planning further 4.x releases, so maybe just create an issue and we can assign it to the 5.0 milestone.

github-actions · 2021-03-15T00:06:10Z

Please comment if you are still working on this PR, as it has been inactive for 30 days. To give everyone a chance to contribute, we are releasing it for new contributors to take over.

github-actions · 2021-06-15T00:01:07Z

Please comment if you are still working on this PR, as it has been inactive for 30 days. To give everyone a chance to contribute, we are releasing it for new contributors to take over.

kingthorin · 2021-12-04T03:44:26Z

@DotDotSlashRepo do you intend to finish this?

kingthorin · 2022-03-11T22:58:36Z

@DotDotSlashRepo do you intend to finish this?

rejahrehim · 2022-03-12T11:11:44Z

...Web_Application_Security_Testing/07-Input_Validation_Testing/20-Testing_for_XXE_Injection.md

+
+The followings source code keyword may apply to C.
+
+- libxml2: xmlCtxtReadMemory,xmlCtxtUseOptions,xmlParseInNodeContext,xmlReadDoc,xmlReadFd,xmlReadFile ,xmlReadIO,xmlReadMemory, xmlCtxtReadDoc ,xmlCtxtReadFd,xmlCtxtReadFile,xmlCtxtReadIO


libxml2: xmlCtxtReadMemory, xmlCtxtUseOptions, xmlParseInNodeContext, xmlReadDoc, xmlReadFd, xmlReadFile, xmlReadIO, xmlReadMemory, xmlCtxtReadDoc, xmlCtxtReadFd, xmlCtxtReadFile, xmlCtxtReadIO

rejahrehim · 2022-03-12T11:12:27Z

...Web_Application_Security_Testing/07-Input_Validation_Testing/20-Testing_for_XXE_Injection.md

+The followings source code keyword may apply to C.
+
+- libxml2: xmlCtxtReadMemory,xmlCtxtUseOptions,xmlParseInNodeContext,xmlReadDoc,xmlReadFd,xmlReadFile ,xmlReadIO,xmlReadMemory, xmlCtxtReadDoc ,xmlCtxtReadFd,xmlCtxtReadFile,xmlCtxtReadIO
+- libxerces-c: XercesDOMParser, SAXParser, SAX2XMLReader


libxerces-c: XercesDOMParser, SAXParser, SAX2XMLReader

ThunderSon · 2022-04-19T22:11:27Z

@RiieCco might you have some time to give this a look?

@kingthorin what is still needed for this? I'll be giving this a look as well.

kingthorin · 2022-04-19T22:15:41Z

Comments from Feb 5th and Rejah’s more recent comments.

ThunderSon · 2022-04-19T22:47:29Z

Alright. Let's re-review that comment, as that seems to be creating an issue, and is not a blocker right now.
Let's try to recall the exact concern and then move this.
This is a good addition, I'll try to review this ASAP.

kingthorin · 2022-04-19T23:20:52Z

It was this discussion:

TODO
Edit top level page to link to test case.
This test case has overlap with WSTG-INPV-07 , XML injection. WSTG-INPV-07 is to be modified to eliminate duplication.
Need to re-order test case, XXE makes more sense to be after XML injection

I'm good with you addressing duplicate content.
However re-ordering things should wait until we are headed to 5.x. Currently we are still planning further 4.x releases, so maybe just create an issue and we can assign it to the 5.0 milestone.

DotDotSlashRepo added 2 commits January 3, 2021 16:49

Create 20-Testing_for_XXE_Injection.md

1cda83c

Added XXE test case.

Update 20-Testing_for_XXE_Injection.md

62d681c

fixed typos and enhanced content

This comment has been minimized.

Sign in to view

Update 20-Testing_for_XXE_Injection.md

839a57c

lint corrections

This comment has been minimized.

Sign in to view

Update 20-Testing_for_XXE_Injection.md

278b82e

fixed typo

kingthorin requested changes Feb 3, 2021

View reviewed changes

DotDotSlashRepo and others added 6 commits February 5, 2021 23:46

Update document/4-Web_Application_Security_Testing/07-Input_Validatio…

11770bc

…n_Testing/20-Testing_for_XXE_Injection.md Co-authored-by: Rick M <[email protected]>

Update document/4-Web_Application_Security_Testing/07-Input_Validatio…

499e9c1

…n_Testing/20-Testing_for_XXE_Injection.md Co-authored-by: Rick M <[email protected]>

Update document/4-Web_Application_Security_Testing/07-Input_Validatio…

0ef1714

…n_Testing/20-Testing_for_XXE_Injection.md Co-authored-by: Rick M <[email protected]>

Update document/4-Web_Application_Security_Testing/07-Input_Validatio…

07d0387

…n_Testing/20-Testing_for_XXE_Injection.md Co-authored-by: Rick M <[email protected]>

Update document/4-Web_Application_Security_Testing/07-Input_Validatio…

bbc8191

…n_Testing/20-Testing_for_XXE_Injection.md Co-authored-by: Rick M <[email protected]>

Update document/4-Web_Application_Security_Testing/07-Input_Validatio…

614c840

…n_Testing/20-Testing_for_XXE_Injection.md Co-authored-by: Rick M <[email protected]>

DotDotSlashRepo and others added 4 commits February 5, 2021 23:51

Update document/4-Web_Application_Security_Testing/07-Input_Validatio…

079c695

…n_Testing/20-Testing_for_XXE_Injection.md Co-authored-by: Rick M <[email protected]>

Update document/4-Web_Application_Security_Testing/07-Input_Validatio…

fd7b8af

…n_Testing/20-Testing_for_XXE_Injection.md Co-authored-by: Rick M <[email protected]>

Update document/4-Web_Application_Security_Testing/07-Input_Validatio…

c1cc6e1

…n_Testing/20-Testing_for_XXE_Injection.md Co-authored-by: Rick M <[email protected]>

Update document/4-Web_Application_Security_Testing/07-Input_Validatio…

c87fa06

…n_Testing/20-Testing_for_XXE_Injection.md Co-authored-by: Rick M <[email protected]>

github-actions bot added the help wanted label Mar 15, 2021

victoriadrake added this to the v4.3 Release milestone Apr 11, 2021

github-actions bot removed the help wanted label Apr 15, 2021

github-actions bot added the help wanted label Jun 15, 2021

github-actions bot removed the help wanted label Jul 15, 2021

kingthorin added the new New content to write label Aug 25, 2021

rejahrehim reviewed Mar 12, 2022

View reviewed changes

ThunderSon self-requested a review April 19, 2022 22:11

DotDotSlashRepo closed this by deleting the head repository Jan 4, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added Test for XXE #710

Added Test for XXE #710

DotDotSlashRepo commented Jan 12, 2021 •

edited

Loading

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

github-actions bot commented Feb 5, 2021

DotDotSlashRepo commented Feb 5, 2021

kingthorin commented Feb 5, 2021 •

edited

Loading

github-actions bot commented Mar 15, 2021

github-actions bot commented Jun 15, 2021

kingthorin commented Dec 4, 2021

kingthorin commented Mar 11, 2022

rejahrehim Mar 12, 2022

rejahrehim Mar 12, 2022

ThunderSon commented Apr 19, 2022

kingthorin commented Apr 19, 2022

ThunderSon commented Apr 19, 2022

kingthorin commented Apr 19, 2022 •

edited

Loading


		The followings source code keyword may apply to C.

		- libxml2: xmlCtxtReadMemory,xmlCtxtUseOptions,xmlParseInNodeContext,xmlReadDoc,xmlReadFd,xmlReadFile ,xmlReadIO,xmlReadMemory, xmlCtxtReadDoc ,xmlCtxtReadFd,xmlCtxtReadFile,xmlCtxtReadIO

Added Test for XXE #710

Added Test for XXE #710

Conversation

DotDotSlashRepo commented Jan 12, 2021 • edited Loading

TODO

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

github-actions bot commented Feb 5, 2021

DotDotSlashRepo commented Feb 5, 2021

kingthorin commented Feb 5, 2021 • edited Loading

github-actions bot commented Mar 15, 2021

github-actions bot commented Jun 15, 2021

kingthorin commented Dec 4, 2021

kingthorin commented Mar 11, 2022

rejahrehim Mar 12, 2022

Choose a reason for hiding this comment

rejahrehim Mar 12, 2022

Choose a reason for hiding this comment

ThunderSon commented Apr 19, 2022

kingthorin commented Apr 19, 2022

ThunderSon commented Apr 19, 2022

kingthorin commented Apr 19, 2022 • edited Loading

DotDotSlashRepo commented Jan 12, 2021 •

edited

Loading

kingthorin commented Feb 5, 2021 •

edited

Loading

kingthorin commented Apr 19, 2022 •

edited

Loading