boostsecurityio/lotp

[LOTP] Add xsltproc

Open

#36 opened on 2024年8月6日

GitHub で見る
 (0 comments) (0 reactions) (0 assignees)HTML (14 forks)auto 404
good first issueidea

Repository metrics

Stars
 (158 stars)
PR merge metrics
 (PR metrics pending)

説明

Description of the LOTP tool

xsltproc makes old-school XXE hard / if not impossible? because of URI constraints, but supported exsl:document extension (exslt.github.io/exsl/elements/document/index.html) provides an arbitrary write primitive (ex. Koha-Community/Koha@main/t/db_dependent/Koha/XSLT/Security.t#L64-L75)

コントリビューターガイド