Study. uk . com
  1. Home
  2. All questions
  3. Question 471

CompTIA Security+ study material · question 471 of 611

An XML parser resolves an external entity supplied by the user and returns a local file's contents. Which configuration change prevents this?

  1. Disabling external entity expansion in the parser
  2. Requiring the document to be signed
  3. Enforcing a schema on the document
  4. Limiting the document size
Show the answer

Answer: A. Disabling external entity expansion in the parser

The flaw is in the parser's entity resolution, so turning that feature off removes the class of attack.

Source: OWASP Top 10 (OWASP) — OWASP Top Ten › Security Misconfiguration

Challenge yourself on this topic → Study as cards