mirrors/nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus synced 2026-01-07 05:56:49 +00:00
Code Issues Releases Wiki Activity

Better configure DocumentBuilderFactory to help prevent XXE (#2132)

Browse Source 
For more information see: https://community.veracode.com/s/article/Java-Remediation-Guidance-for-XXE
This commit is contained in:
Ben McIlwain
2023-08-30 10:17:37 -04:00
committed by GitHub
parent ebf07833e5
commit 6b5ec36eed
3 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
prober/src/main/java/google/registry/monitoring/blackbox/message/EppMessage.java
View File

@@ -153,6 +153,14 @@ public class EppMessage {
xpath = XPathFactory.newInstance().newXPath();
xpath.setNamespaceContext(new EppNamespaceContext());
docBuilderFactory.setNamespaceAware(true);
try {
// Disable DTDs
docBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
} catch (ParserConfigurationException e) {
throw new RuntimeException("Error configuring DocumentBuilderFactory", e);
}
docBuilderFactory.setXIncludeAware(false); // disable XML Inclusions
docBuilderFactory.setExpandEntityReferences(false); // disable expand entity reference nodes
String path = "./xsd/";
StreamSource[] sources;