Skip to main content

XML parser XXE vulnerability

org.openrewrite.java.security.XmlParserXXEVulnerability

Avoid exposing dangerous features of the XML parser by updating certain factory settings.

Tags​

  • CWE-611

Recipe source​

This recipe is only available to users of Moderne.

This recipe is available under the Moderne Proprietary License.

Examples​

Example 1​
Before​
import javax.xml.parsers.DocumentBuilderFactory;

public class XmlParser {
    public void parse() {
        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
        dbf.newDocumentBuilder();
    }
}
After​
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;

public class XmlParser {
    public void parse() {
        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
        String FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";
        try {
            dbf.setFeature(FEATURE, true);
        } catch (ParserConfigurationException e) {
            throw new IllegalStateException("ParserConfigurationException was thrown. The feature '"
                    + FEATURE + "' is not supported by your XML processor.", e);
        }
        dbf.newDocumentBuilder();
    }
}
Example 2​
Before​
import javax.xml.stream.XMLInputFactory;
import javax.xml.stream.XMLStreamReader;
import java.io.InputStream;
public class MyXmlReader {
    public void parseXML(InputStream input) {
        XMLInputFactory f = XMLInputFactory.newInstance();
        XMLStreamReader reader = f.createXMLStreamReader(input);
    }
}
After​
import javax.xml.stream.XMLInputFactory;
import javax.xml.stream.XMLStreamReader;
import java.io.InputStream;
public class MyXmlReader {
    public void parseXML(InputStream input) {
        XMLInputFactory f = XMLInputFactory.newInstance();
        f.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
        f.setProperty(XMLInputFactory.SUPPORT_DTD, false);
        XMLStreamReader reader = f.createXMLStreamReader(input);
    }
}
Example 3​
Before​
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.ParserConfigurationException; // catching unsupported features
import javax.xml.XMLConstants;

class myDBFReader {
    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
    DocumentBuilder safebuilder = dbf.newDocumentBuilder();
}
After​
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.ParserConfigurationException; // catching unsupported features
import javax.xml.XMLConstants;

class myDBFReader {
    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();

    {
        String FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";
        try {
            dbf.setFeature(FEATURE, true);
        } catch (ParserConfigurationException e) {
            throw new IllegalStateException("ParserConfigurationException was thrown. The feature '"
                    + FEATURE + "' is not supported by your XML processor.", e);
        }

    }
    DocumentBuilder safebuilder = dbf.newDocumentBuilder();
}
Example 4​
Before​
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.Transformer;
import javax.xml.transform.Source;

class MyTransformerFactory {
    void XMLTransformer(Source source) {
        TransformerFactory tf = TransformerFactory.newInstance();
        Transformer transformer = tf.newTransformer(source);
    }
}
After​
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.Transformer;
import javax.xml.XMLConstants;
import javax.xml.transform.Source;

class MyTransformerFactory {
    void XMLTransformer(Source source) {
        TransformerFactory tf = TransformerFactory.newInstance();
        tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
        tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
        tf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
        Transformer transformer = tf.newTransformer(source);
    }
}
Example 5​
Before​
import javax.xml.transform.TransformerFactory;

class MyTransformerFactory {
    private TransformerFactory tf;
    public MyTransformerFactory() {
        tf = TransformerFactory.newInstance();
    }
}
After​
import javax.xml.XMLConstants;
import javax.xml.transform.TransformerFactory;

class MyTransformerFactory {
    private TransformerFactory tf;
    public MyTransformerFactory() {
        tf = TransformerFactory.newInstance();
        tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
        tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
        tf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
    }
}

Usage​

This recipe has no required configuration options. Users of Moderne can run it via the Moderne CLI:

You will need to have configured the Moderne CLI on your machine before you can run the following command.

shell
mod run . --recipe XmlParserXXEVulnerability

If the recipe is not available locally, then you can install it using:

mod config recipes jar install org.openrewrite.recipe:rewrite-java-security:3.7.0

See how this recipe works across multiple open-source repositories​

Run this recipe on OSS repos at scale with the Moderne SaaS.

The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.

Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.

Data Tables​

Source files that had results​

org.openrewrite.table.SourcesFileResults

Source files that were modified by the recipe run.

Column NameDescription
Source path before the runThe source path of the file before the run. null when a source file was created during the run.
Source path after the runA recipe may modify the source path. This is the path after the run. null when a source file was deleted during the run.
Parent of the recipe that made changesIn a hierarchical recipe, the parent of the recipe that made a change. Empty if this is the root of a hierarchy or if the recipe is not hierarchical at all.
Recipe that made changesThe specific recipe that made a change.
Estimated time savingAn estimated effort that a developer to fix manually instead of using this recipe, in unit of seconds.
CycleThe recipe cycle in which the change was made.