Skip to content

Commit eef4fc3

Browse files
Apply suggestions from code review
Co-authored-by: mc <[email protected]>
1 parent da67b10 commit eef4fc3

File tree

1 file changed

+3
-3
lines changed
  • swift/ql/src/queries/Security/CWE-611

1 file changed

+3
-3
lines changed

swift/ql/src/queries/Security/CWE-611/XXE.qhelp

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<overview>
55
<p>
66
Parsing untrusted XML files with a weakly configured XML parser may lead to an XML External Entity (XXE) attack. This type of attack
7-
uses external entity references to access arbitrary files on a system, carry out denial of service, or server side
7+
uses external entity references to access arbitrary files on a system, carry out denial-of-service attacks, or server-side
88
request forgery. Even when the result of parsing is not returned to the user, out-of-band
99
data retrieval techniques may allow attackers to steal sensitive data. Denial of services can also be
1010
carried out in this situation.
@@ -46,8 +46,8 @@ OWASP:
4646
<a href="https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html">XML External Entity Prevention Cheat Sheet</a>.
4747
</li>
4848
<li>
49-
Timothy Morgen:
50-
<a href="https://research.nccgroup.com/2014/05/19/xml-schema-dtd-and-entity-attacks-a-compendium-of-known-techniques/">XML Schema, DTD, and Entity Attacks</a>.
49+
Timothy D. Morgan and Omar Al Ibrahim
50+
<a href="https://research.nccgroup.com/2014/05/19/xml-schema-dtd-and-entity-attacks-a-compendium-of-known-techniques/">XML Schema, DTD, and Entity Attacks: A Compendium of Known Techniques</a>.
5151
</li>
5252
<li>
5353
Timur Yunusov, Alexey Osipov:

0 commit comments

Comments
 (0)