boostsecurityio/lotp

[LOTP] Add xsltproc

Open

#36 opened on Aug 6, 2024

View on GitHub
 (0 comments) (0 reactions) (0 assignees)HTML (14 forks)auto 404
good first issueidea

Repository metrics

Stars
 (158 stars)
PR merge metrics
 (PR metrics pending)

Description

Description of the LOTP tool

xsltproc makes old-school XXE hard / if not impossible? because of URI constraints, but supported exsl:document extension (exslt.github.io/exsl/elements/document/index.html) provides an arbitrary write primitive (ex. Koha-Community/Koha@main/t/db_dependent/Koha/XSLT/Security.t#L64-L75)

Contributor guide

Research direction
Write a short entry for xsltproc explaining its XXE potential and the exsl:document extension for arbitrary write.
Tech stack
None
Domain
security
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
1
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
None
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
90