This is what you need to do:
Using a web based de-compiler ( www.javadecompilers.com ),
you can get all the source code for the jar file jackson-all-1.9.11.jar .
(This will work on any version of Jackson )
The fixes are fairly simple!
In the 1.9.x version the following 2 files allow XML entity injection.
org/codehaus/jackson/xc/DomElementJsonDeserializer.java
org/codehaus/jackson/map/ext/DOMDeserializer.java
When you update the jar be sure to update the additional nested inner classes.
org/codehaus/jackson/map/ext/DOMDeserializer.class
org/codehaus/jackson/map/ext/DOMDeserializer$DocumentDeserializer.class
org/codehaus/jackson/map/ext/DOMDeserializer$NodeDeserializer.class
org/codehaus/jackson/xc/DomElementJsonDeserializer.class
In the 2.x.x version the package name has changed.
These files need to be modified
com/fasterxml/jackson/databind/ext/DOMDeserializer.java
com/fasterxml/jackson/dataformat/xml/XmlFactory.java
The in the 1.9 version the solution to stop Entity injection is to add the following line to the two files.
.setFeature(javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true);
Here is where to add it to the de-compiled code,
then recompile the files, and update the jar files.
public abstract class DOMDeserializer<T>
extends FromStringDeserializer<T> {
static final DocumentBuilderFactory _parserFactory;
static {
_parserFactory = DocumentBuilderFactory.newInstance();
/* CVE-2016-3720 */
try {
_parserFactory.setFeature(javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true);
} catch (ParserConfigurationException e) {
e.printStackTrace();
}
// Move this line from the static block lower in the file.
_parserFactory.setNamespaceAware(true);
}
public DomElementJsonDeserializer() {
super(Element.class);
try {
DocumentBuilderFactory bf = DocumentBuilderFactory.newInstance();
bf.setNamespaceAware(true);
/* CVE-2016-3720 */
bf.setFeature(javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true);
this.builder = bf.newDocumentBuilder();
}
catch (ParserConfigurationException e) {
throw new RuntimeException();
}
}
In the 2.x version, you need to modify this file slightly differently.
Add the line:
xmlIn.setProperty("javax.xml.stream.isSupportingExternalEntities", Boolean.FALSE);
package com.fasterxml.jackson.dataformat.xml;
public class XmlFactory
extends JsonFactory {
protected XmlFactory(ObjectCodec oc, int xpFeatures, int xgFeatures, XMLInputFactory xmlIn, XMLOutputFactory xmlOut, String nameForTextElem) {
super(oc);
this._xmlParserFeatures = xpFeatures;
this._xmlGeneratorFeatures = xgFeatures;
this._cfgNameForTextElement = nameForTextElem;
if (xmlIn == null) {
xmlIn = XMLInputFactory.newInstance();
xmlIn.setProperty("javax.xml.stream.isSupportingExternalEntities", Boolean.FALSE);
}
I hope you found this helpful.