Skip to Content.
Sympa Menu

xom-interest - Re: [XOM-interest] secure parsing

xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Chronological Thread  
  • From: Elliotte Rusty Harold <elharo AT ibiblio.org>
  • To: XOM API for Processing XML with Java <xom-interest AT lists.ibiblio.org>
  • Subject: Re: [XOM-interest] secure parsing
  • Date: Tue, 16 Sep 2014 06:27:04 -0400

It can be done but it's not as easy as it probably should be.

You'd need to start by setting up a SAX XMLReader configured to use a
custom EntityResolver that returns the empty string for all entities you
don't want to load (or just for all entities). Then you pass this to the
XOM Builder constructor.

On Tue, Sep 16, 2014 at 5:06 AM, Mike Wilson <mikewse AT hotmail.com> wrote:

> [resending as subscriber]
>
> Hi,
>
> We are using XOM to communicate XML over the internet and need to protect
> ourselves from XML hacks such as mentioned on:
> <https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing
> >
> https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing
>
> What is the most straight-forward way to configure XOM to achieve this?
>
> Currently we are just doing:
> Builder builder = new Builder();
> Document doc = builder.build(new StringReader(xmlstr));
>
> Thanks
> Mike
> _______________________________________________
> XOM-interest mailing list
> XOM-interest AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/xom-interest
>



--
Elliotte Rusty Harold
elharo AT ibiblio.org




Archive powered by MHonArc 2.6.24.

Top of Page