svn commit: r289557 - /webservices/soap/trunk/java/src/org/apache/soap/util/xml/XMLParserUtils.java

[d***@apache.org]

Author: dims
Date: Fri Sep 16 07:21:58 2005
New Revision: 289557

URL: http://svn.apache.org/viewcvs?rev=289557&view=rev
Log:
switch off various parser options to prevent XXE attacks.

Modified:
webservices/soap/trunk/java/src/org/apache/soap/util/xml/XMLParserUtils.java

Modified: webservices/soap/trunk/java/src/org/apache/soap/util/xml/XMLParserUtils.java
URL: http://svn.apache.org/viewcvs/webservices/soap/trunk/java/src/org/apache/soap/util/xml/XMLParserUtils.java?rev=289557&r1=289556&r2=289557&view=diff
==============================================================================
--- webservices/soap/trunk/java/src/org/apache/soap/util/xml/XMLParserUtils.java (original)
+++ webservices/soap/trunk/java/src/org/apache/soap/util/xml/XMLParserUtils.java Fri Sep 16 07:21:58 2005
@@ -118,7 +118,30 @@
// Optional: set various configuration options
dbf.setNamespaceAware(namespaceAware);
dbf.setValidating(validating);
+
+ // Add various options explicitly to prevent XXE attacks. add try/catch around every
+ // setAttribute just in case a specific parser does not support it.
dbf.setExpandEntityReferences(expandEntityReferences);
+ try {
+ dbf.setAttribute("http://xml.org/sax/features/external-general-entities",
+ Boolean.FALSE);
+ } catch (Throwable t) { }
+ try {
+ dbf.setAttribute("http://xml.org/sax/features/external-parameter-entities",
+ Boolean.FALSE);
+ } catch (Throwable t) { }
+ try {
+ dbf.setAttribute("http://apache.org/xml/features/disallow-doctype-decl",
+ Boolean.TRUE);
+ } catch (Throwable t) { }
+ try {
+ dbf.setAttribute("http://javax.xml.XMLConstants/feature/secure-processing",
+ Boolean.TRUE);
+ } catch (Throwable t) { }
+ try {
+ dbf.setAttribute("http://apache.org/xml/features/nonvalidating/load-external-dtd",
+ Boolean.FALSE);
+ } catch (Throwable t) { }

try {
// Some parsers don't throw an exception here, but throw one when the

[Sanjiva Weerawarana]

Hi Dims,

Post by d***@apache.org
Author: dims
Date: Fri Sep 16 07:21:58 2005
New Revision: 289557
URL: http://svn.apache.org/viewcvs?rev=289557&view=rev
switch off various parser options to prevent XXE attacks.

XXE?

You seem to be turning off many SAX options .. Apache SOAP as you know
only uses DOM. ??

Sanjiva.