Skip to Content.
Sympa Menu

xom-interest - Re: [XOM-interest] secure parsing

xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Chronological Thread  
  • From: Mike Wilson <mikewse AT hotmail.com>
  • To: "'XOM API for Processing XML with Java'" <xom-interest AT lists.ibiblio.org>
  • Subject: Re: [XOM-interest] secure parsing
  • Date: Tue, 16 Sep 2014 16:28:18 +0200

Never mind, having the XMLReader stuff as a dependency is ok.
This is the resulting code:

XMLReader reader = XMLReaderFactory.createXMLReader();
reader.setEntityResolver(new EntityResolver() {
public InputSource resolveEntity ... {
return new InputSource(); // no contents
}
});
Builder builder = new Builder(reader);

Thanks
Mike

Mike Wilson wrote:
> Thanks, Elliot
>
> Is there any way to do this without introducing dependencies to other
> libraries? Currently we only depend on XOM and use all its default
> behaviour.
>
> And just to double-check; you don't have any solution similar
> to setFeature
> to disable this? You mention in the tutorial that XOM controls f ex
> external-general-entities and external-parameter-entities.
>
> Best regards
> Mike
>
> Elliotte Rusty Harold wrote:
> > It can be done but it's not as easy as it probably should be.
> >
> > You'd need to start by setting up a SAX XMLReader
> configured to use a
> > custom EntityResolver that returns the empty string for all
> > entities you
> > don't want to load (or just for all entities). Then you pass
> > this to the
> > XOM Builder constructor.
> >
> > On Tue, Sep 16, 2014 at 5:06 AM, Mike Wilson
> > <mikewse AT hotmail.com> wrote:
> >
> > > [resending as subscriber]
> > >
> > > Hi,
> > >
> > > We are using XOM to communicate XML over the internet and
> > need to protect
> > > ourselves from XML hacks such as mentioned on:
> > >
> > <https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29
> > _Processing
> > > >
> > >
> > https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_
> > Processing
> > >
> > > What is the most straight-forward way to configure XOM to
> > achieve this?
> > >
> > > Currently we are just doing:
> > > Builder builder = new Builder();
> > > Document doc = builder.build(new StringReader(xmlstr));
> > >
> > > Thanks
> > > Mike
> > > _______________________________________________
> > > XOM-interest mailing list
> > > XOM-interest AT lists.ibiblio.org
> > > http://lists.ibiblio.org/mailman/listinfo/xom-interest
> > >
> >
> >
> >
> > --
> > Elliotte Rusty Harold
> > elharo AT ibiblio.org
> > _______________________________________________
> > XOM-interest mailing list
> > XOM-interest AT lists.ibiblio.org
> > http://lists.ibiblio.org/mailman/listinfo/xom-interest
> >
>
> _______________________________________________
> XOM-interest mailing list
> XOM-interest AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/xom-interest
>





Archive powered by MHonArc 2.6.24.

Top of Page