XOM API for Processing XML with Java

[Mike Wilson <mikewse AT hotmail.com>]

In the end I changed it to this which more closely resembles the suggestions
by OWASP:

XMLReader reader = XMLReaderFactory.createXMLReader();
reader.setFeature(
  "http://xml.org/sax/features/external-general-entities";, false);
reader.setFeature(
  "http://xml.org/sax/features/external-parameter-entities";, false);
reader.setFeature(
  "http://apache.org/xml/features/disallow-doctype-decl";, true);
Builder builder = new Builder(reader);
Document doc = builder.build(new StringReader(value)); 

Mike Wilson wrote:
> Never mind, having the XMLReader stuff as a dependency is ok.
> This is the resulting code:
> 
> XMLReader reader = XMLReaderFactory.createXMLReader();
> reader.setEntityResolver(new EntityResolver() {
>   public InputSource resolveEntity ... {
>     return new InputSource(); // no contents
>   }
> });
> Builder builder = new Builder(reader); 
> 
> Thanks
> Mike
> 
> Mike Wilson wrote:
> > Thanks, Elliot 
> > 
> > Is there any way to do this without introducing 
> dependencies to other
> > libraries? Currently we only depend on XOM and use all its default
> > behaviour.
> > 
> > And just to double-check; you don't have any solution similar 
> > to setFeature
> > to disable this? You mention in the tutorial that XOM controls f ex
> > external-general-entities and external-parameter-entities.
> > 
> > Best regards
> > Mike
> > 
> > Elliotte Rusty Harold wrote:
> > > It can be done but it's not as easy as it probably should be.
> > > 
> > > You'd need to start by setting up a SAX XMLReader 
> > configured to use a
> > > custom EntityResolver that returns the empty string for all 
> > > entities you
> > > don't want to load (or just for all entities). Then you pass 
> > > this to the
> > > XOM Builder constructor.
> > > 
> > > On Tue, Sep 16, 2014 at 5:06 AM, Mike Wilson 
> > > <mikewse AT hotmail.com> wrote:
> > > 
> > > > [resending as subscriber]
> > > >
> > > > Hi,
> > > >
> > > > We are using XOM to communicate XML over the internet and 
> > > need to protect
> > > > ourselves from XML hacks such as mentioned on:
> > > >  
> > > <https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29
> > > _Processing
> > > > >
> > > > 
> > > https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_
> > > Processing
> > > >
> > > > What is the most straight-forward way to configure XOM to 
> > > achieve this?
> > > >
> > > > Currently we are just doing:
> > > >     Builder builder = new Builder();
> > > >     Document doc = builder.build(new StringReader(xmlstr));
> > > >
> > > > Thanks
> > > > Mike
> > > > _______________________________________________
> > > > XOM-interest mailing list
> > > > XOM-interest AT lists.ibiblio.org
> > > > http://lists.ibiblio.org/mailman/listinfo/xom-interest
> > > >
> > > 
> > > 
> > > 
> > > -- 
> > > Elliotte Rusty Harold
> > > elharo AT ibiblio.org
> > > _______________________________________________
> > > XOM-interest mailing list
> > > XOM-interest AT lists.ibiblio.org
> > > http://lists.ibiblio.org/mailman/listinfo/xom-interest
> > > 
> > 
> > _______________________________________________
> > XOM-interest mailing list
> > XOM-interest AT lists.ibiblio.org
> > http://lists.ibiblio.org/mailman/listinfo/xom-interest
> > 
> 
> _______________________________________________
> XOM-interest mailing list
> XOM-interest AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/xom-interest
>