Come prevenire iniezione XML come XML Bomba e di attacco XXE

Question

Sto sviluppando un'applicazione Android con

android:minSdkVersion="14" 

In questa applicazione nella necessità di analizzare un xml.For che sto usando un parser DOM come questo

DocumentBuilderFactory dbFactory = DocumentBuilderFactory.newInstance(); 
DocumentBuilder dBuilder = null; 
Document doc = null; 
try {  
    dBuilder = dbFactory.newDocumentBuilder(); 
} catch (ParserConfigurationException e) { 
    e.printStackTrace(); 
} 

Ma quando il codice viene controllato per la sicurezza ho avuto due problemi di sicurezza on line

dBuilder = dbFactory.newDocumentBuilder();, che sono

1.xml Entity espansione iniezione (Bomb XML)

2.XML entità esterna di iniezione (attacco XXE)

Dopo qualche ricerca ho aggiunto la linea dbFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

Ma ora io che ottiene un'eccezione quando si esegue questa linea

javax.xml.parsers.ParserConfigurationException: http://javax.xml.XMLConstants/feature/secure-processing 

Qualcuno può aiutarmi?

Answer 1

Hai provato il seguente snippet da OWASP page?

import javax.xml.parsers.DocumentBuilderFactory; 
import javax.xml.parsers.ParserConfigurationException; // catching unsupported features 
... 

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); 
try { 
    // This is the PRIMARY defense. If DTDs (doctypes) are disallowed, almost all XML entity attacks are prevented 
    // Xerces 2 only - http://xerces.apache.org/xerces2-j/features.html#disallow-doctype-decl 
    String FEATURE = "http://apache.org/xml/features/disallow-doctype-decl"; 
    dbf.setFeature(FEATURE, true); 

    // If you can't completely disable DTDs, then at least do the following: 
    // Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-general-entities 
    // Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-general-entities 
    FEATURE = "http://xml.org/sax/features/external-general-entities"; 
    dbf.setFeature(FEATURE, false); 

    // Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-parameter-entities 
    // Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-parameter-entities 
    FEATURE = "http://xml.org/sax/features/external-parameter-entities"; 
    dbf.setFeature(FEATURE, false); 

    // and these as well, per Timothy Morgan's 2014 paper: "XML Schema, DTD, and Entity Attacks" (see reference below) 
    dbf.setXIncludeAware(false); 
    dbf.setExpandEntityReferences(false); 

    // And, per Timothy Morgan: "If for some reason support for inline DOCTYPEs are a requirement, then 
    // ensure the entity settings are disabled (as shown above) and beware that SSRF attacks 
    // (http://cwe.mitre.org/data/definitions/918.html) and denial 
    // of service attacks (such as billion laughs or decompression bombs via "jar:") are a risk." 

    // remaining parser logic 
    ... 

    catch (ParserConfigurationException e) { 
     // This should catch a failed setFeature feature 
     logger.info("ParserConfigurationException was thrown. The feature '" + 
        FEATURE + 
        "' is probably not supported by your XML processor."); 
     ... 
    } 
    catch (SAXException e) { 
     // On Apache, this should be thrown when disallowing DOCTYPE 
     logger.warning("A DOCTYPE was passed into the XML document"); 
     ... 
    } 
    catch (IOException e) { 
     // XXE that points to a file that doesn't exist 
     logger.error("IOException occurred, XXE may still possible: " + e.getMessage()); 
     ... 
    } 

Answer 2

String JAXBContext = "com.fnf.dfbatch.jaxb";

JAXBContext jc = null; 
    Unmarshaller u = null; 
    String FEATURE_GENERAL_ENTITIES = "http://xml.org/sax/features/external-general-entities"; 
    String FEATURE_PARAMETER_ENTITIES = "http://xml.org/sax/features/external-parameter-entities"; 
    try { 
     jc = JAXBContext.newInstance(jaxbContext); 
     u = jc.createUnmarshaller(); 
     /*jobsDef = (BatchJobs) u.unmarshal(DfBatchDriver.class 
       .getClassLoader().getResourceAsStream(
         DfJobManager.configFile));*/ 

     DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();   
     dbf.setFeature(FEATURE_GENERAL_ENTITIES, false);    
     dbf.setFeature(FEATURE_PARAMETER_ENTITIES, false);  
     dbf.setXIncludeAware(false); 
     dbf.setExpandEntityReferences(false); 
     DocumentBuilder db = dbf.newDocumentBuilder(); 
     Document document = db.parse(DfBatchDriver.class 
       .getClassLoader().getResourceAsStream(
         DfJobManager.configFile)); 
     jobsDef = (BatchJobs) u.unmarshal(document);