February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
325
24
장
XXE 방어
XXE
방어
CHAPTER
24
일반적으로 말해서
XXE
는 막기가 정말 쉽다.
XML
파서에서 외부 엔티티를 비활성화하기만
하면 된다(그림
24
-
1
).
XML
파서에 따라 방법은 다르지만 보통 다음과 같이 한 줄의 구성으
로 충분하다.
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
OWASP
에 따르면 자바 기반
XML
파서는
XXE
활성화를 기본값으로 하는 것이 많아
XXE
에
특히 취약하다. 어떤 언어와 파서를 사용하는가에 따라
XXE
를 비활성화하는 구성이 기본값일
수도 있다.
사용자가
XXE
를 포함하는
XML
페이로드를 요청한다.
서버의 파서가
XML
을 파싱한다.
서버 리소스가 액세스되어 반사될
가능성이 있다.
파서가 엔티티 태그를 거부한다.
부적절한
구성
적절한
구성
그림
24-1
XML
파서를 적절히 구성함으로써
XXE
공격을 쉽게 차단할 수 있다.
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.