Skip to content

Commit 887d80f

Browse files
NapalysNapalys
committed
Added change note
1 parent 1851deb commit 887d80f

1 file changed

Lines changed: 4 additions & 0 deletions

File tree

‎javascript/ql/lib/change-notes/2025-07-15-xml-bomb-sinks.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Removed `libxmljs` as an XML bomb sink. The underlying libxml2 library now includes [entity reference loop detection](https://github.com/GNOME/libxml2/blob/0c948334a8f5c66d50e9f8992e62998017dc4fc6/NEWS#L905-L908) that prevents XML bomb attacks.

0 commit comments

Comments
 (0)