Prevent XXE Attack with JAXB

by

JAXB

You can prevent the Xml eXternal Entity (XXE) attack by unmarshalling from an XMLStreamReader that has the IS_SUPPORTING_EXTERNAL_ENTITIES and/or XMLInputFactory.SUPPORT_DTD properties set to false.

JAX-WS

A JAX-WS implementation should take care of this for you. If it doesn’t I would recommend opening a bug against the specific implmententation.

EXAMPLE

Demo

package xxe;

import javax.xml.bind.*;
import javax.xml.stream.*;
import javax.xml.transform.stream.StreamSource;

public class Demo {

    public static void main(String[] args) throws Exception {
        JAXBContext jc = JAXBContext.newInstance(Customer.class);

        XMLInputFactory xif = XMLInputFactory.newFactory();
        xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
        xif.setProperty(XMLInputFactory.SUPPORT_DTD, false);
        XMLStreamReader xsr = xif.createXMLStreamReader(new StreamSource("src/xxe/input.xml"));

        Unmarshaller unmarshaller = jc.createUnmarshaller();
        Customer customer = (Customer) unmarshaller.unmarshal(xsr);

        Marshaller marshaller = jc.createMarshaller();
        marshaller.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, true);
        marshaller.marshal(customer, System.out);
    }

}

input.xml

This XML document contains an entity that has been setup to get the listing of files I used to create this example.

<?xml version="1.0"?>
<!DOCTYPE customer
[
<!ENTITY name SYSTEM "/Users/bdoughan/Examples/src/xxe/">
]
>
<customer>
  <name>&name;</name>
</customer>

Customer

package xxe;

import javax.xml.bind.annotation.XmlRootElement;

@XmlRootElement
public class Customer {

    private String name;

    public String getName() {
        return name;
    }

    public void setName(String name) {
        this.name = name;
    }

}

Output – Default Configuration

By default the entity will be resolved.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<customer>
    <name>Customer.java
Demo.java
input.xml
</name>
</customer>

Output when XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES property is set to false

When this property is set the entity is not resolved.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<customer>
    <name></name>
</customer>

Output when XMLInputFactory.SUPPORT_DTD property is set to false

When this property is set an exception is thrown trying to resolve the entity.

Exception in thread "main" javax.xml.bind.UnmarshalException
 - with linked exception:
[javax.xml.stream.XMLStreamException: ParseError at [row,col]:[8,15]
Message: The entity "name" was referenced, but not declared.]
    at com.sun.xml.bind.v2.runtime.unmarshaller.UnmarshallerImpl.handleStreamException(UnmarshallerImpl.java:436)
    at com.sun.xml.bind.v2.runtime.unmarshaller.UnmarshallerImpl.unmarshal0(UnmarshallerImpl.java:372)
    at com.sun.xml.bind.v2.runtime.unmarshaller.UnmarshallerImpl.unmarshal(UnmarshallerImpl.java:342)
    at xxe.Demo.main(Demo.java:18)
Caused by: javax.xml.stream.XMLStreamException: ParseError at [row,col]:[8,15]
Message: The entity "name" was referenced, but not declared.
    at com.sun.org.apache.xerces.internal.impl.XMLStreamReaderImpl.next(XMLStreamReaderImpl.java:598)
    at com.sun.xml.bind.v2.runtime.unmarshaller.StAXStreamConnector.bridge(StAXStreamConnector.java:196)
    at com.sun.xml.bind.v2.runtime.unmarshaller.UnmarshallerImpl.unmarshal0(UnmarshallerImpl.java:370)
    ... 2 more

More Related Contents:

  1. Why is char[] preferred over String for passwords?
  2. How to resolve java.lang.NoClassDefFoundError: javax/xml/bind/JAXBException
  3. Encrypt Password in Configuration Files? [closed]
  4. How to deal with a slow SecureRandom generator?
  5. Allowing Java to use an untrusted certificate for SSL/HTTPS connection
  6. Difference between java.util.Random and java.security.SecureRandom
  7. jaxb unmarshal timestamp
  8. Using JAXB to unmarshal/marshal a List
  9. java.lang.VerifyError: Expecting a stackmap frame at branch target JDK 1.7
  10. Which artifacts should I use for JAXB RI in my Maven project?
  11. JAXB Marshalling Unmarshalling with CDATA
  12. JAXB – Property “Value” is already defined. Use to resolve this conflict
  13. JAXB Exception: Class not known to this context
  14. Unit testing with Spring Security
  15. How do you customize how JAXB generates plural method names?
  16. How can I construct a java.security.PublicKey object from a base64 encoded string?
  17. Application vulnerability due to Non Random Hash Functions
  18. no suitable HttpMessageConverter found for response type
  19. How to make generated classes contain Javadoc from XML Schema documentation
  20. JAXB inheritance, unmarshal to subclass of marshaled class
  21. How to marshal without a namespace?
  22. How generate XMLElementWrapper annotation with xjc and customized binding
  23. JAXB unmarshall with namespaces and prefix
  24. Using StAX to create index for XML for quick access
  25. javax.xml.bind.UnmarshalException: unexpected element (uri:””, local:”Group”)
  26. Jaxb: how to unmarshall xs:any XML-string part?
  27. Java XML Binding [closed]
  28. How to check if class exists somewhere in package?
  29. Proper fix for Java 10 complaining about illegal reflection access by jaxb-impl 2.3.0?
  30. How are the IV and authentication tag handled for “AES/GCM/NoPadding”?

Leave a Comment