Content Security Policy -unsafe eval

[pchawla]

Thanks for the update.
I don't see the a newer build yet in the build location for 10.0p/Enterprise. We will try this out once a build is avail...

[pchawla]

No, we do not see the entity expansion error. It still throws an out of memory exception. Attached the stacktrace.
Below mentioned are the version...

[pchawla]

Hi,
Any update on this? This is a critical issue for us. Any updates on the same would be well appreciated. Thanks!

[pchawla]

The default parser for us is xerces which gets picked up. We are able to turn on/off features for code we have access to, by updating parser features...

[pchawla]

Just a correction. We still use version v10.0.
I could see that there the same fix is available for 10.0 as well.
But I think only &quo...

[pchawla]

HI,
We have a requirement where we want to remove "unsafe-eval" from CSP header for security concerns. On removing unsafe-eval from "script-src"...

[pchawla]

Hi,
Yes I am talking about Billion laughs attack. Can you please help me with the patch build number where it is fixed for version: v10.1p_2016-07-22/Enterprise...

[pchawla]

UI sends ISC.do requests as xml request. In case, attacker adds a bomb to the request, the parsing of XML in isomorphic code crashes the server. I have...