Skip to Content.
Sympa Menu

xom-interest - Re: [XOM-interest] secure parsing

xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Chronological Thread  
  • From: Mike Wilson <mikewse AT hotmail.com>
  • To: "'XOM API for Processing XML with Java'" <xom-interest AT lists.ibiblio.org>
  • Subject: Re: [XOM-interest] secure parsing
  • Date: Tue, 16 Sep 2014 13:56:36 +0200

Thanks, Elliot

Is there any way to do this without introducing dependencies to other
libraries? Currently we only depend on XOM and use all its default
behaviour.

And just to double-check; you don't have any solution similar to setFeature
to disable this? You mention in the tutorial that XOM controls f ex
external-general-entities and external-parameter-entities.

Best regards
Mike

Elliotte Rusty Harold wrote:
> It can be done but it's not as easy as it probably should be.
>
> You'd need to start by setting up a SAX XMLReader configured to use a
> custom EntityResolver that returns the empty string for all
> entities you
> don't want to load (or just for all entities). Then you pass
> this to the
> XOM Builder constructor.
>
> On Tue, Sep 16, 2014 at 5:06 AM, Mike Wilson
> <mikewse AT hotmail.com> wrote:
>
> > [resending as subscriber]
> >
> > Hi,
> >
> > We are using XOM to communicate XML over the internet and
> need to protect
> > ourselves from XML hacks such as mentioned on:
> >
> <https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29
> _Processing
> > >
> >
> https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_
> Processing
> >
> > What is the most straight-forward way to configure XOM to
> achieve this?
> >
> > Currently we are just doing:
> > Builder builder = new Builder();
> > Document doc = builder.build(new StringReader(xmlstr));
> >
> > Thanks
> > Mike
> > _______________________________________________
> > XOM-interest mailing list
> > XOM-interest AT lists.ibiblio.org
> > http://lists.ibiblio.org/mailman/listinfo/xom-interest
> >
>
>
>
> --
> Elliotte Rusty Harold
> elharo AT ibiblio.org
> _______________________________________________
> XOM-interest mailing list
> XOM-interest AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/xom-interest
>





Archive powered by MHonArc 2.6.24.

Top of Page