16

I ran my java code against sonarqube and I got 'Disable XML external entity (XXE) processing' as vulnerability. I spend some time on google to resolve the issue. I have been trying alot of approach but nothing is working for me. I don't know what I'm missing

My Code:

        final DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
        docFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
        docFactory.setFeature(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
        docFactory.setFeature(XMLInputFactory.SUPPORT_DTD, false);

        docFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
        docFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
        docFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
        docFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);

        final DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
        final Document doc = docBuilder.parse(filepath);

I'm using java 1.8, Any help is appreciated. Thanks

3
  • Have you had a look at : stackoverflow.com/questions/40649152/how-to-prevent-xxe-attack and this rule from Sonar: sonarcloud.io/organizations/alexlittle-github/…
    – iCrus
    Jun 26, 2019 at 16:49
  • 2
    Your code looks fine to me, perhaps the checker is just being stupid. Also, what people so often forget is that the XXE vulnerability only applies if you are processing untrusted XML. If you know where the XML came from and trust the code that generated it, XXE is not an issue. Unfortunately though the security people don't always understand that subtlety. Jun 26, 2019 at 17:18
  • Hi iCrus. I have tried all those possibilities from sonarqube but still I didn't fixed yet
    – cheetoo
    Jun 26, 2019 at 17:41

4 Answers 4

16

I end up adding all of the following attributes in order to avoid Sonar complaining about this vulnerability:

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();

//REDHAT
//https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf
factory.setAttribute(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");

//OWASP
//https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
// Disable external DTDs as well
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
// and these as well, per Timothy Morgan's 2014 paper: "XML Schema, DTD, and Entity Attacks"
factory.setXIncludeAware(false);
factory.setExpandEntityReferences(false);

DocumentBuilder builder = factory.newDocumentBuilder();
8

Java 9+ solution:

For me changing DocumentBuilderFactory.newInstance() to DocumentBuilderFactory.newDefaultInstance() was enough to red rid of this warning.

5
  • 1
    Don't see the method newDefaultInstance() on javax.xml.parsers.DocumentBuilderFactory
    – Anand
    Jul 9, 2020 at 13:43
  • @Anand it was introduced in Java 9.
    – Line
    Jul 10, 2020 at 11:32
  • 4
    With no additionnal information, this sounds more like a way to defeat Sonar's check (e.g. it does not know about this method, so it does not mark it), and not to solve the underlying vulnerability. Basically, it looks like you went and did the just same, but behind sonar's back. (Once more, without additionnal information).
    – GPI
    Jan 13, 2021 at 9:55
  • @GPI that may be true, I haven't investigate it. If anyone knows the reason behind such behaviour, please feel free to edit the answer adding it
    – Line
    Jan 14, 2021 at 12:14
  • This solution works with 'XMLInputFactory'. Along with this we need to add the property xmlInputFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, ""); Feb 14, 2023 at 12:22
5

It should be enough to just set this two properties:

factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
0
1

I have fixed this issue by adding the below code snippet :

saxParserFactory = SAXParserFactory.newInstance();
saxParserFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
saxParserFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
saxParserFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);    
saxParserFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
saxParserFactory.setXIncludeAware(false);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.