Skip to content

Commit

Permalink
Fix the Fixie,,,
Browse files Browse the repository at this point in the history
  • Loading branch information
gtencate committed May 17, 2015
1 parent fbf285b commit 1011287
Show file tree
Hide file tree
Showing 5 changed files with 3 additions and 10 deletions.
6 changes: 0 additions & 6 deletions etc/requirements.txt

This file was deleted.

Expand Up @@ -4,7 +4,7 @@ Session cookies (domain)
**Example:**

/*
Setting the Domain attribute to a too permissive value, such as example.com
Setting the "Domain" attribute to a too permissive value, such as "example.com"
allows an attacker to launch attacks on the session IDs between different hosts and
web applications belonging to the same domain, known as cross-subdomain cookies.
For example, vulnerabilities in www.example.com might allow an attacker to get access
Expand Down
Expand Up @@ -38,15 +38,15 @@ XML External entities
to cause the runtime to throw an exception if a <!DOCTYPE> element is present in the XML:

At this point, we have hardened this code so that it is much less vulnerable to XML bombs,
but we havent yet addressed the dangers posed by malicious external entities.
but we haven't yet addressed the dangers posed by malicious external entities.
You can improve your resilience against these attacks if you customize the behavior
of XmlReader by changing its XmlResolver. XmlResolver objects are used to resolve external
references, including external entities. XmlTextReader instances, as well as XmlReader
instances returned from calls to XmlReader.Create, are prepopulated with default
XmlResolvers (actually XmlUrlResolvers). You can prevent XmlReader from resolving
external entities while still allowing it to resolve inline entities by setting the
XmlResolver property of XmlReaderSettings to null. This is attack surface reduction
at work again; if you dont need the capability, turn it off:
at work again; if you don't need the capability, turn it off:
*/

XmlReaderSettings settings = new XmlReaderSettings();
Expand Down
Binary file modified skf/skf.db
Binary file not shown.
1 change: 0 additions & 1 deletion skf/test_skf.py
Expand Up @@ -95,7 +95,6 @@ def test_code_base_items(client):
assert b'Knowledge Base Code Examples' in rv.data
assert b'File upload' in rv.data
assert b'Input validation' in rv.data
assert b'Single input validation' in rv.data
assert b'Debug enabling' in rv.data
assert b'Anti caching headers' in rv.data

Expand Down

0 comments on commit 1011287

Please sign in to comment.