XOM API for Processing XML with Java

[Mike Wilson <mikewse AT hotmail.com>]

Create secretfile.txt containing a line of text.

String value = "<!DOCTYPE root [<!ENTITY foo SYSTEM
"C:\\dir\\secretfile.txt">]><text>&foo;</text>";
XMLReader reader = XMLReaderFactory.createXMLReader();
reader.setFeature("http://xml.org/sax/features/external-general-entities";,
false);
reader.setFeature("http://xml.org/sax/features/external-parameter-entities";,
false);
reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl";,
true);
Builder builder = new Builder(reader);
Document doc = builder.build(new StringReader(value));

Now verify that the text from secretfile.txt is not in doc.

Best regards
Mike

Elliotte Rusty Harold wrote:
> Interesting. Do you have  test case that shows that working?
> 
> On Wed, Sep 17, 2014 at 3:46 PM, Mike Wilson 
> <mikewse AT hotmail.com> wrote:
> 
> > Oh, right, that was mentioned in the tutorial. Still, my testing
> > proved this to work. But I'm on an older XOM version - maybe
> > this behaviour only applies to later versions?
> >
> > FWIW I think this is a potentially risky behaviour. People may
> > believe they are securing their parser the way I did and still
> > be open to attacks. This specific attack is quite bad news as it
> > allows the attacker to list arbitrary files on the server (f ex
> > /etc/passwd).
> >
> > Best regards
> > Mike
> >
> > Elliotte Rusty Harold wrote:
> > > That's not going to work. XOM will reset those features after
> > > you set them.
> > >
> > > On Tue, Sep 16, 2014 at 3:49 PM, Mike Wilson
> > > <mikewse AT hotmail.com> wrote:
> > >
> > > > In the end I changed it to this which more closely resembles the
> > > > suggestions
> > > > by OWASP:
> > > >
> > > > XMLReader reader = XMLReaderFactory.createXMLReader();
> > > > reader.setFeature(
> > > >   
> "http://xml.org/sax/features/external-general-entities";, false);
> > > > reader.setFeature(
> > > >   
> "http://xml.org/sax/features/external-parameter-entities";, false);
> > > > reader.setFeature(
> > > >   "http://apache.org/xml/features/disallow-doctype-decl";, true);
> > > > Builder builder = new Builder(reader);
> > > > Document doc = builder.build(new StringReader(value));
> > > >
> > > > Mike Wilson wrote:
> > > > > Never mind, having the XMLReader stuff as a dependency is ok.
> > > > > This is the resulting code:
> > > > >
> > > > > XMLReader reader = XMLReaderFactory.createXMLReader();
> > > > > reader.setEntityResolver(new EntityResolver() {
> > > > >   public InputSource resolveEntity ... {
> > > > >     return new InputSource(); // no contents
> > > > >   }
> > > > > });
> > > > > Builder builder = new Builder(reader);
> > > > >
> > > > > Thanks
> > > > > Mike
> > > > >
> > > > > Mike Wilson wrote:
> > > > > > Thanks, Elliot
> > > > > >
> > > > > > Is there any way to do this without introducing
> > > > > dependencies to other
> > > > > > libraries? Currently we only depend on XOM and use all
> > > its default
> > > > > > behaviour.
> > > > > >
> > > > > > And just to double-check; you don't have any 
> solution similar
> > > > > > to setFeature
> > > > > > to disable this? You mention in the tutorial that XOM
> > > controls f ex
> > > > > > external-general-entities and external-parameter-entities.
> > > > > >
> > > > > > Best regards
> > > > > > Mike
> > > > > >
> > > > > > Elliotte Rusty Harold wrote:
> > > > > > > It can be done but it's not as easy as it 
> probably should be.
> > > > > > >
> > > > > > > You'd need to start by setting up a SAX XMLReader
> > > > > > configured to use a
> > > > > > > custom EntityResolver that returns the empty 
> string for all
> > > > > > > entities you
> > > > > > > don't want to load (or just for all entities). 
> Then you pass
> > > > > > > this to the
> > > > > > > XOM Builder constructor.
> > > > > > >
> > > > > > > On Tue, Sep 16, 2014 at 5:06 AM, Mike Wilson
> > > > > > > <mikewse AT hotmail.com> wrote:
> > > > > > >
> > > > > > > > [resending as subscriber]
> > > > > > > >
> > > > > > > > Hi,
> > > > > > > >
> > > > > > > > We are using XOM to communicate XML over the 
> internet and
> > > > > > > need to protect
> > > > > > > > ourselves from XML hacks such as mentioned on:
> > > > > > > >
> > > > > > > 
> <https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29
> > > > > > > _Processing
> > > > > > > > >
> > > > > > > >
> > > > > > > 
> https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_
> > > > > > > Processing
> > > > > > > >
> > > > > > > > What is the most straight-forward way to 
> configure XOM to
> > > > > > > achieve this?
> > > > > > > >
> > > > > > > > Currently we are just doing:
> > > > > > > >     Builder builder = new Builder();
> > > > > > > >     Document doc = builder.build(new 
> StringReader(xmlstr));
> > > > > > > >
> > > > > > > > Thanks
> > > > > > > > Mike
> > > > > > > > _______________________________________________
> > > > > > > > XOM-interest mailing list
> > > > > > > > XOM-interest AT lists.ibiblio.org
> > > > > > > > http://lists.ibiblio.org/mailman/listinfo/xom-interest
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > --
> > > > > > > Elliotte Rusty Harold
> > > > > > > elharo AT ibiblio.org
> > > > > > > _______________________________________________
> > > > > > > XOM-interest mailing list
> > > > > > > XOM-interest AT lists.ibiblio.org
> > > > > > > http://lists.ibiblio.org/mailman/listinfo/xom-interest
> > > > > > >
> > > > > >
> > > > > > _______________________________________________
> > > > > > XOM-interest mailing list
> > > > > > XOM-interest AT lists.ibiblio.org
> > > > > > http://lists.ibiblio.org/mailman/listinfo/xom-interest
> > > > > >
> > > > >
> > > > > _______________________________________________
> > > > > XOM-interest mailing list
> > > > > XOM-interest AT lists.ibiblio.org
> > > > > http://lists.ibiblio.org/mailman/listinfo/xom-interest
> > > > >
> > > >
> > > > _______________________________________________
> > > > XOM-interest mailing list
> > > > XOM-interest AT lists.ibiblio.org
> > > > http://lists.ibiblio.org/mailman/listinfo/xom-interest
> > > >
> > >
> > >
> > >
> > > --
> > > Elliotte Rusty Harold
> > > elharo AT ibiblio.org
> > > _______________________________________________
> > > XOM-interest mailing list
> > > XOM-interest AT lists.ibiblio.org
> > > http://lists.ibiblio.org/mailman/listinfo/xom-interest
> > >
> >
> > _______________________________________________
> > XOM-interest mailing list
> > XOM-interest AT lists.ibiblio.org
> > http://lists.ibiblio.org/mailman/listinfo/xom-interest
> >
> 
> 
> 
> -- 
> Elliotte Rusty Harold
> elharo AT ibiblio.org
> _______________________________________________
> XOM-interest mailing list
> XOM-interest AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/xom-interest
>