Customize request XML parsing
Hi, is there a way of customizing the request XML parsing process in SOAP UI? I have already tried to check out the sources and intervene there but the codebase has proven to be a bit overwhelming...
Forum Discussion
See below documentation helps.
https://www.soapui.org/getting-started/soapui-interface/preferences-and-settings.html
See turning off validate requests on Editor Settings helps.
https://www.soapui.org/getting-started/soapui-interface/preferences-and-settings.html
See turning off validate requests on Editor Settings helps.
That was one of the solutions I tried as well - it is really starting to seem like it is validated somewhere deep, deep in the source code(or maybe I`m too much of a novice to find it).
Weird thing is that classical entity(just a string value replacement):
<!DOCTYPE replacements [
<!ENTITY replacement "Replaced value gets through">
]>
<foo>&replacement;</foo>
gets through and is present in the response as opposed to any other variation of XXE(xml bomb, replacements with results from FTP/HTTP/FILE links).
Anyways I think I`ll have to move away from SOAP UI for my XXE demo - really wanted to utilize it, I am a fan of the product.
I still appreciate you trying to help nmrao! Have a nice day!
- Hmm; may be you can try & instead of &
Thank you for the suggestion, but alas it is not the answer...
Weird thing is there are test samples for XXE attacks in the sources, so it should be possible to test them:
https://github.com/SmartBear/soapui/tree/next/soapui/src/main/resources/com/eviware/soapui/resources/security/xmlbomb
Wondering if there is indeed some setting I haven`t enabled/disabled that is preventing me from testing just these exact payloads...
