Skip to content

Harden XML parsing against XXE #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jbuncle merged 1 commit into from
Mar 29, 2026
Merged

Harden XML parsing against XXE #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 27 additions & 3 deletions src/main/java/uk/co/jbuncle/hnapclient/util/xml/XMLUtility.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
import java.io.StringWriter;
import java.util.LinkedList;
import java.util.List;
import javax.xml.XMLConstants;
import javax.xml.bind.JAXBContext;
import javax.xml.bind.JAXBException;
import javax.xml.bind.Marshaller;
Expand All @@ -16,6 +17,7 @@
import javax.xml.parsers.ParserConfigurationException;
import javax.xml.transform.OutputKeys;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerConfigurationException;
import javax.xml.transform.TransformerException;
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.dom.DOMSource;
Expand All @@ -37,7 +39,7 @@ public class XMLUtility {

public static String toString(final Node node) throws XMLException {
try {
final TransformerFactory tf = TransformerFactory.newInstance();
final TransformerFactory tf = newSecureTransformerFactory();
final Transformer transformer = tf.newTransformer();
transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes");
final StringWriter writer = new StringWriter();
Expand All @@ -51,7 +53,7 @@ public static String toString(final Node node) throws XMLException {

public static Document loadXML(final String xml) throws XMLException {
try {
final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
final DocumentBuilderFactory factory = newSecureDocumentBuilderFactory();
final DocumentBuilder builder = factory.newDocumentBuilder();
final InputSource is = new InputSource(new StringReader(xml));
return builder.parse(is);
Expand Down Expand Up @@ -92,7 +94,7 @@ public static Document marshall(final Object object) throws XMLException {
final Marshaller m = jaxbContext.createMarshaller();
m.setProperty(Marshaller.JAXB_ENCODING, "UTF-8");

final DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
final DocumentBuilderFactory dbf = newSecureDocumentBuilderFactory();
dbf.setNamespaceAware(true);
final DocumentBuilder db = dbf.newDocumentBuilder();
final Document doc = db.newDocument();
Expand All @@ -106,6 +108,28 @@ public static Document marshall(final Object object) throws XMLException {
}
}

private static DocumentBuilderFactory newSecureDocumentBuilderFactory() throws ParserConfigurationException {
final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setXIncludeAware(false);
factory.setExpandEntityReferences(false);
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
return factory;
}

private static TransformerFactory newSecureTransformerFactory() throws TransformerConfigurationException {
final TransformerFactory transformerFactory = TransformerFactory.newInstance();
transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
return transformerFactory;
}

public static List<Element> getChildElements(final Node element) {
final List<Element> childElements = new LinkedList<>();
final NodeList childNodes = element.getChildNodes();
Expand Down
Loading