एक्सएमएल बम और XXE हमले की तरह एक्सएमएल इंजेक्शन

Question

मैं एक xml.For है कि मैं इस

की तरह एक डोम पार्सर का उपयोग कर रहा पार्स करने के लिए

android:minSdkVersion="14" 

के साथ एक Android आवेदन जरूरत में इस ऐप्लिकेशन में विकासशील रहा से कैसे बचें

DocumentBuilderFactory dbFactory = DocumentBuilderFactory.newInstance(); 
DocumentBuilder dBuilder = null; 
Document doc = null; 
try {  
    dBuilder = dbFactory.newDocumentBuilder(); 
} catch (ParserConfigurationException e) { 
    e.printStackTrace(); 
} 

लेकिन जब कोड की सुरक्षा के लिए चेक किया गया है मैं लाइन

dBuilder = dbFactory.newDocumentBuilder(); पर दो सुरक्षा मुद्दों, जो

कर रहे हैं मिल गया

1.XML प्रविष्टि विस्तार इंजेक्शन (एक्सएमएल बम)

2.XML बाहरी संस्था इंजेक्शन (XXE हमले)

कुछ शोध मैं लाइन जोड़ा बाद dbFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

लेकिन अब मैं जब यह लाइन निष्पादित की जाती है तो

javax.xml.parsers.ParserConfigurationException: http://javax.xml.XMLConstants/feature/secure-processing 

क्या कोई मेरी मदद कर सकता है?

Answer 1

क्या आपने निम्न स्निपेट को OWASP page से आजमाया है?

import javax.xml.parsers.DocumentBuilderFactory; 
import javax.xml.parsers.ParserConfigurationException; // catching unsupported features 
... 

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); 
try { 
    // This is the PRIMARY defense. If DTDs (doctypes) are disallowed, almost all XML entity attacks are prevented 
    // Xerces 2 only - http://xerces.apache.org/xerces2-j/features.html#disallow-doctype-decl 
    String FEATURE = "http://apache.org/xml/features/disallow-doctype-decl"; 
    dbf.setFeature(FEATURE, true); 

    // If you can't completely disable DTDs, then at least do the following: 
    // Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-general-entities 
    // Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-general-entities 
    FEATURE = "http://xml.org/sax/features/external-general-entities"; 
    dbf.setFeature(FEATURE, false); 

    // Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-parameter-entities 
    // Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-parameter-entities 
    FEATURE = "http://xml.org/sax/features/external-parameter-entities"; 
    dbf.setFeature(FEATURE, false); 

    // and these as well, per Timothy Morgan's 2014 paper: "XML Schema, DTD, and Entity Attacks" (see reference below) 
    dbf.setXIncludeAware(false); 
    dbf.setExpandEntityReferences(false); 

    // And, per Timothy Morgan: "If for some reason support for inline DOCTYPEs are a requirement, then 
    // ensure the entity settings are disabled (as shown above) and beware that SSRF attacks 
    // (http://cwe.mitre.org/data/definitions/918.html) and denial 
    // of service attacks (such as billion laughs or decompression bombs via "jar:") are a risk." 

    // remaining parser logic 
    ... 

    catch (ParserConfigurationException e) { 
     // This should catch a failed setFeature feature 
     logger.info("ParserConfigurationException was thrown. The feature '" + 
        FEATURE + 
        "' is probably not supported by your XML processor."); 
     ... 
    } 
    catch (SAXException e) { 
     // On Apache, this should be thrown when disallowing DOCTYPE 
     logger.warning("A DOCTYPE was passed into the XML document"); 
     ... 
    } 
    catch (IOException e) { 
     // XXE that points to a file that doesn't exist 
     logger.error("IOException occurred, XXE may still possible: " + e.getMessage()); 
     ... 
    } 

Answer 2

स्ट्रिंग jaxbContext = "com.fnf.dfbatch.jaxb";

JAXBContext jc = null; 
    Unmarshaller u = null; 
    String FEATURE_GENERAL_ENTITIES = "http://xml.org/sax/features/external-general-entities"; 
    String FEATURE_PARAMETER_ENTITIES = "http://xml.org/sax/features/external-parameter-entities"; 
    try { 
     jc = JAXBContext.newInstance(jaxbContext); 
     u = jc.createUnmarshaller(); 
     /*jobsDef = (BatchJobs) u.unmarshal(DfBatchDriver.class 
       .getClassLoader().getResourceAsStream(
         DfJobManager.configFile));*/ 

     DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();   
     dbf.setFeature(FEATURE_GENERAL_ENTITIES, false);    
     dbf.setFeature(FEATURE_PARAMETER_ENTITIES, false);  
     dbf.setXIncludeAware(false); 
     dbf.setExpandEntityReferences(false); 
     DocumentBuilder db = dbf.newDocumentBuilder(); 
     Document document = db.parse(DfBatchDriver.class 
       .getClassLoader().getResourceAsStream(
         DfJobManager.configFile)); 
     jobsDef = (BatchJobs) u.unmarshal(document);