diff options
author | Morten Tokle <mortent@yahooinc.com> | 2022-12-08 08:58:26 +0100 |
---|---|---|
committer | Morten Tokle <mortent@yahooinc.com> | 2022-12-08 08:58:26 +0100 |
commit | 10f52b59bd196ad99d2c2343640967fb25470374 (patch) | |
tree | 301401534049043bdc6d6232b3c2816bb06f7d6a /config-application-package | |
parent | b6b016d92875d8a6e4aff7257979c0fd58467c5a (diff) |
Add more xxe preventions
Diffstat (limited to 'config-application-package')
-rw-r--r-- | config-application-package/src/main/java/com/yahoo/config/application/Xml.java | 29 |
1 files changed, 19 insertions, 10 deletions
diff --git a/config-application-package/src/main/java/com/yahoo/config/application/Xml.java b/config-application-package/src/main/java/com/yahoo/config/application/Xml.java index dc5ae998586..2cc5e1ac4e2 100644 --- a/config-application-package/src/main/java/com/yahoo/config/application/Xml.java +++ b/config-application-package/src/main/java/com/yahoo/config/application/Xml.java @@ -35,12 +35,7 @@ public class Xml { private static final Logger log = Logger.getLogger(Xml.class.getPackage().toString()); // Access to this needs to be synchronized (as it is in getDocumentBuilder() below) - private static final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); - - static { - factory.setNamespaceAware(true); - factory.setXIncludeAware(false); - } + private static final DocumentBuilderFactory factory = createDocumentBuilderFactory(); public static Document getDocument(Reader reader) { Document doc; @@ -52,6 +47,23 @@ public class Xml { return doc; } + private static DocumentBuilderFactory createDocumentBuilderFactory() { + DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); + factory.setNamespaceAware(true); + factory.setXIncludeAware(false); + + try { + // XXE prevention + factory.setFeature("http://xml.org/sax/features/external-general-entities", false); + factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); + return factory; + } catch (ParserConfigurationException e) { + log.log(Level.SEVERE, "Could not initialize XML parser", e); + throw new RuntimeException(e); + } + } + /** * Creates a new XML document builder. * @@ -67,10 +79,7 @@ public class Xml { } static DocumentBuilder getPreprocessDocumentBuilder() throws ParserConfigurationException { - DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); - factory.setFeature("http://xml.org/sax/features/external-general-entities", false); // XXE prevention - factory.setNamespaceAware(true); - factory.setXIncludeAware(false); + DocumentBuilderFactory factory = createDocumentBuilderFactory(); factory.setValidating(false); return factory.newDocumentBuilder(); } |