[JIRA] (IDP-2050) Support auto-throwing EntityResolver in default ParserPool

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiYWIwYzhlYjMyMWJlNDkxMjgzMTkyY2Q4ZTgyYjVlOGIiLCJwIjoiaiJ9 ) / Improvement ( https://shibboleth.atlassian.net/browse/IDP-2050?atlOrigin=eyJpIjoiYWIwYzhlYjMyMWJlNDkxMjgzMTkyY2Q4ZTgyYjVlOGIiLCJwIjoiaiJ9 ) IDP-2050 ( https://shibboleth.atlassian.net/browse/IDP-2050?atlOrigin=eyJpIjoiYWIwYzhlYjMyMWJlNDkxMjgzMTkyY2Q4ZTgyYjVlOGIiLCJwIjoiaiJ9 ) Support auto-throwing EntityResolver in default ParserPool ( https://shibboleth.atlassian.net/browse/IDP-2050?atlOrigin=eyJpIjoiYWIwYzhlYjMyMWJlNDkxMjgzMTkyY2Q4ZTgyYjVlOGIiLCJwIjoiaiJ9 )

Issue Type: Improvement Assignee: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) Components: Configuration, Profile Handling Created: 08/Dec/22 2:13 PM Fix Versions: 4.3.0 Priority: Trivial Reporter: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 )

The default configuration of the BasicParserPool class doesn’t include an EntityResolver. Based on testing, and other changes, it is expected to be true that none of our core parsing should ever involve any external entities. Having the option to block all entity resolution in this layer seems wise, possibly defaulting to that for V5.

( https://shibboleth.atlassian.net/browse/IDP-2050#add-comment?atlOrigin=eyJpIjoiYWIwYzhlYjMyMWJlNDkxMjgzMTkyY2Q4ZTgyYjVlOGIiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-2050#add-comment?atlOrigin=eyJpIjoiYWIwYzhlYjMyMWJlNDkxMjgzMTkyY2Q4ZTgyYjVlOGIiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100212- sha1:8cdcfbb )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20221208/e5d9359c/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-82a00a60-b5a2-4d86-9a5a-7176e9b8722d
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221208/e5d9359c/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-d118faef-55b8-467e-a767-8c75ef54e091
Type: image/png
Size: 448 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221208/e5d9359c/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-ae90a0e6-9fe8-49bd-ac5c-f8c6dd6dc651
Type: image/png
Size: 446 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221208/e5d9359c/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-b085b8be-484a-4b8f-a66e-9cdb7c92765b
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221208/e5d9359c/attachment-0007.png>