{"push_id":1035531113,"size":1,"distinct_size":1,"ref":"refs/heads/release14.12","head":"630911ee3f2dc09e0547db707d6a926eb1af79dd","before":"d3794e52556fc89720330c575959457af8ab91aa","commits":[{"sha":"630911ee3f2dc09e0547db707d6a926eb1af79dd","author":{"email":"811c1987b169139c3599e569bb8f018ce8f2d742@apache.org","name":"Jacques Le Roux"},"message":"\"Applied fix from trunk for revision: 1736434  \" \n------------------------------------------------------------------------\nr1736434 | jleroux | 2016-03-24 13:12:11 +0100 (jeu. 24 mars 2016) | 7 lignes\n\nFixes \"Update XStream lib to prevent XML External Entity (XXE) Processing\" - https://issues.apache.org/jira/browse/OFBIZ-6959\n\nThe XStream team has released the 1.4.9 stable version in March 15, 2016\nThis version fixes the XML External Entity (XXE) Processing security issue https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing\nSince OFBiz uses the DomDriver, with Java 6 at least in supported releases, OFBiz seems not really vulnerable https://x-stream.github.io/faq.html#Security_XXEVulnerability, but better to be safe than sorry, notably for not OOTB uses...\n\n\n------------------------------------------------------------------------\n\u001A\n\ngit-svn-id: https://svn.apache.org/repos/asf/ofbiz/branches/release14.12@1736436 13f79535-47bb-0310-9956-ffa450edef68","distinct":true,"url":"https://api.github.com/repos/apache/ofbiz/commits/630911ee3f2dc09e0547db707d6a926eb1af79dd"}]}