Re: [xsl] Saxon vulnerability

["Roger L Costello costello@xxxxxxxxx" <xsl-list-service@xxxxxxxxxxxxxxxxxxxxxx>]

Thank you again, Martin. I want to be certain that I have this correct, so I
can give my colleagues accurate information.

Is this accurate:

SAXON has a configuration property allowedProtocols that can be set to
"https,http" to allow only HTTPS and HTTP URIs to be resolved, while file URI
access should fail (i.e., access to the file should be blocked). However, when
allowedProtocols is set, SAXON fails to block file access when the string
given to unparsed-text contains a user-defined entity--via an ENTITY
declaration in a DTD--and the entity references a file.

Workaround: disable DTDs completely.