hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 13:45:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Note that FEATURE_SECURE_PROCESSING isn't a sufficient defence against XXE

Browse Source
This commit is contained in:
Chris Smowton
2021-11-25 12:21:24 +00:00
parent 609d6011a2
commit 9eb9eb606e
3 changed files with 6 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/test/query-tests/security/CWE-611/DocumentBuilderTests.java
View File

@@ -25,14 +25,14 @@ class DocumentBuilderTests {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
DocumentBuilder builder = factory.newDocumentBuilder();
builder.parse(sock.getInputStream()); //safe
builder.parse(sock.getInputStream()); //unsafe -- secure-processing by itself is insufficient
}
public void enableSecurityFeature2(Socket sock) throws Exception {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://javax.xml.XMLConstants/feature/secure-processing", true);
DocumentBuilder builder = factory.newDocumentBuilder();
builder.parse(sock.getInputStream()); //safe
builder.parse(sock.getInputStream()); //safe -- secure-processing by itself is insufficient
}
public void enableDTD(Socket sock) throws Exception {