{"action":"created","issue":{"url":"https://api.github.com/repos/x-stream/xstream/issues/25","labels_url":"https://api.github.com/repos/x-stream/xstream/issues/25/labels{/name}","comments_url":"https://api.github.com/repos/x-stream/xstream/issues/25/comments","events_url":"https://api.github.com/repos/x-stream/xstream/issues/25/events","html_url":"https://github.com/x-stream/xstream/issues/25","id":105175980,"number":25,"title":"XXE vulnerability ","user":{"login":"guykoth","id":1426077,"avatar_url":"https://avatars.githubusercontent.com/u/1426077?v=3","gravatar_id":"","url":"https://api.github.com/users/guykoth","html_url":"https://github.com/guykoth","followers_url":"https://api.github.com/users/guykoth/followers","following_url":"https://api.github.com/users/guykoth/following{/other_user}","gists_url":"https://api.github.com/users/guykoth/gists{/gist_id}","starred_url":"https://api.github.com/users/guykoth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guykoth/subscriptions","organizations_url":"https://api.github.com/users/guykoth/orgs","repos_url":"https://api.github.com/users/guykoth/repos","events_url":"https://api.github.com/users/guykoth/events{/privacy}","received_events_url":"https://api.github.com/users/guykoth/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/x-stream/xstream/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":{"login":"joehni","id":795149,"avatar_url":"https://avatars.githubusercontent.com/u/795149?v=3","gravatar_id":"","url":"https://api.github.com/users/joehni","html_url":"https://github.com/joehni","followers_url":"https://api.github.com/users/joehni/followers","following_url":"https://api.github.com/users/joehni/following{/other_user}","gists_url":"https://api.github.com/users/joehni/gists{/gist_id}","starred_url":"https://api.github.com/users/joehni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joehni/subscriptions","organizations_url":"https://api.github.com/users/joehni/orgs","repos_url":"https://api.github.com/users/joehni/repos","events_url":"https://api.github.com/users/joehni/events{/privacy}","received_events_url":"https://api.github.com/users/joehni/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/x-stream/xstream/milestones/1","html_url":"https://github.com/x-stream/xstream/milestones/1.4.x","labels_url":"https://api.github.com/repos/x-stream/xstream/milestones/1/labels","id":1170865,"number":1,"title":"1.4.x","description":null,"creator":{"login":"joehni","id":795149,"avatar_url":"https://avatars.githubusercontent.com/u/795149?v=3","gravatar_id":"","url":"https://api.github.com/users/joehni","html_url":"https://github.com/joehni","followers_url":"https://api.github.com/users/joehni/followers","following_url":"https://api.github.com/users/joehni/following{/other_user}","gists_url":"https://api.github.com/users/joehni/gists{/gist_id}","starred_url":"https://api.github.com/users/joehni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joehni/subscriptions","organizations_url":"https://api.github.com/users/joehni/orgs","repos_url":"https://api.github.com/users/joehni/repos","events_url":"https://api.github.com/users/joehni/events{/privacy}","received_events_url":"https://api.github.com/users/joehni/received_events","type":"User","site_admin":false},"open_issues":1,"closed_issues":4,"state":"open","created_at":"2015-06-18T15:17:37Z","updated_at":"2015-10-05T18:41:05Z","due_on":null,"closed_at":null},"comments":2,"created_at":"2015-09-07T08:53:09Z","updated_at":"2015-10-05T18:42:48Z","closed_at":null,"body":"DTD processing was enabled and therefore, XML deserialization process was vulnerable to XML External Entity Injection (I was able to expose local files).\r\nhttps://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing\r\n \r\nSuggestion is to ignore client-side DOCTYPE declarations."},"comment":{"url":"https://api.github.com/repos/x-stream/xstream/issues/comments/145627371","html_url":"https://github.com/x-stream/xstream/issues/25#issuecomment-145627371","issue_url":"https://api.github.com/repos/x-stream/xstream/issues/25","id":145627371,"user":{"login":"joehni","id":795149,"avatar_url":"https://avatars.githubusercontent.com/u/795149?v=3","gravatar_id":"","url":"https://api.github.com/users/joehni","html_url":"https://github.com/joehni","followers_url":"https://api.github.com/users/joehni/followers","following_url":"https://api.github.com/users/joehni/following{/other_user}","gists_url":"https://api.github.com/users/joehni/gists{/gist_id}","starred_url":"https://api.github.com/users/joehni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joehni/subscriptions","organizations_url":"https://api.github.com/users/joehni/orgs","repos_url":"https://api.github.com/users/joehni/repos","events_url":"https://api.github.com/users/joehni/events{/privacy}","received_events_url":"https://api.github.com/users/joehni/received_events","type":"User","site_admin":false},"created_at":"2015-10-05T18:42:48Z","updated_at":"2015-10-05T18:42:48Z","body":"As far as possible I've turned off processing of external entities for all affected parsers."}}