Properly configure SchemaFactory to prevent XEE attacks via the document being validated
Thomas Leplus <[email protected]> Tue, 13 Oct 2020 09:32:10 -0700
| Newsgroups | gmane.text.xml.xerces-j.user |
|---|---|
| Message-ID | <CANHA9OFTa5sUEUFe7R6Q3ODZov+X8e0o4Y7cnoBH5sPbZSursw@mail.gmail.com> |
--00000000000090b6be05b18ff5c4
Content-Type: text/plain; charset="UTF-8"
Hello,
I am trying to create a utility method to build a SchemaFactory configured
out-of-the-box to handle XML External Entity (XEE) attacks. The goal is to
have a centralized factory that takes care of all the configuration in a
single place.
I am currently doing this:
SchemaFactory sf = SchemaFactory.newInstance(schemaLanguage);
sf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
sf.setFeature("http://apache.org/xml/features/disallow-doctype-decl",
true);
The idea is to disable all DTDs (which is OK in my case). But when I try
the following test:
public static final String VALID_XML_SCHEMA
= "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
+ "<xs:schema xmlns:xs=\"http://www.w3.org/2001/XMLSchema\">"
+ " <xs:element name=\"note\"/>"
+ "</xs:schema>";
public static final String VALID_XML_DOC_WITH_EXTERNAL_GENERAL_ENTITY
= "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
+ "<!DOCTYPE note ["
+ " <!ELEMENT note ANY >"
+ " <!ENTITY space SYSTEM \"note.dtd\">"
+ "]>"
+ "<note>&space;</note>";
...
SchemaFactory factory =
SecureXML.createSchemaFactory(XMLConstants.W3C_XML_SCHEMA_NS_URI);
Schema schema = factory.newSchema(new StreamSource(new
ByteArrayInputStream(VALID_XML_SCHEMA.getBytes())));
Validator validator = schema.newValidator();
validator.validate(new StreamSource(new
ByteArrayInputStream(VALID_XML_DOC_WITH_EXTERNAL_GENERAL_ENTITY.getBytes())));
I get the following exception:
java.io.FileNotFoundException: note.dtd (No such file or directory)
Which means the DTD is not ignored and so the XEE vulnerability is still
there. Note that XXE attempts in the XSD itself seem to be thwarted.
I have tried the various approaches listed on the OWASP XEE cheatsheet (
https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)
but as far as I can tell, none of them work with Xerces2.
Here is my complete pom.xml for reference:
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>org.leplus.infsec</groupId>
<artifactId>xee</artifactId>
<version>0.0.1-SNAPSHOT</version>
<packaging>jar</packaging>
<name>xee</name>
<url>http://maven.apache.org</url>
<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
</properties>
<dependencies>
<dependency>
<groupId>xalan</groupId>
<artifactId>xalan</artifactId>
<version>2.7.2</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>xerces</groupId>
<artifactId>xercesImpl</artifactId>
<version>2.12.0</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>4.12</version>
<scope>test</scope>
</dependency>
</dependencies>
</project>
I have also created a GitHub project (https://github.com/thomasleplus/xee)
with all my source code and JUnit test case if someone want to
reproduce/test the issue. I have also created a GitHub project (
https://github.com/thomasleplus/xee) with all my source code and JUnit test
case if someone wants to reproduce/test the issue.
Thank you in advance for any help you can provide,
Tom
--00000000000090b6be05b18ff5c4
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr">Hello,<br><br>I am trying to create a utility method to bu=
ild a SchemaFactory configured out-of-the-box to handle XML External Entity=
(XEE) attacks. The goal is to have a centralized factory that takes care o=
f all the configuration in a single place.<br><br>I am currently doing this=
:<br><br><span style=3D"font-family:monospace">=C2=A0=C2=A0 SchemaFactory s=
f =3D SchemaFactory.newInstance(schemaLanguage);<br>=C2=A0=C2=A0 sf.setFeat=
ure(XMLConstants.FEATURE_SECURE_PROCESSING, true);<br>=C2=A0=C2=A0 sf.setFe=
ature("<a href=3D"http://apache.org/xml/features/disallow-doctype-decl=
" target=3D"_blank">http://apache.org/xml/features/disallow-doctype-decl</a=
>", true);</span><br><br>The idea is to disable all DTDs (which is OK =
in my case). But when I try the following test:<br><br><span style=3D"font-=
family:monospace">=C2=A0 =C2=A0 public static final String VALID_XML_SCHEMA=
<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =3D "<?xml version=3D=
\"1.0\" encoding=3D\"UTF-8\"?>"<br>=C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 + "<xs:schema xmlns:xs=3D\"<a =
href=3D"http://www.w3.org/2001/XMLSchema%5C" target=3D"_blank">http://www.w=
3.org/2001/XMLSchema\</a>">"<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 + " =C2=A0<xs:element name=3D\"note\"/>&=
quot;<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 + "</xs:schema&g=
t;";<br><br>=C2=A0 =C2=A0 public static final String VALID_XML_DOC_WIT=
H_EXTERNAL_GENERAL_ENTITY<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =3D =
"<?xml version=3D\"1.0\" encoding=3D\"UTF-8\"?&=
gt;"<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 + "<!DOCTYPE=
note ["<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 + " =C2=A0&=
lt;!ELEMENT note ANY >"<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 + " =C2=A0<!ENTITY space SYSTEM \"note.dtd\">"=
;<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 + "]>"<br>=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 + "<note>&space;</=
note>";<br><br>=C2=A0 =C2=A0...<br><br>=C2=A0 =C2=A0SchemaFactory f=
actory =3D SecureXML.createSchemaFactory(XMLConstants.W3C_XML_SCHEMA_NS_URI=
);<br>=C2=A0 =C2=A0Schema schema =3D factory.newSchema(new StreamSource(new=
ByteArrayInputStream(VALID_XML_SCHEMA.getBytes())));<br>=C2=A0 =C2=A0Valid=
ator validator =3D schema.newValidator();<br>=C2=A0 =C2=A0validator.validat=
e(new StreamSource(new ByteArrayInputStream(VALID_XML_DOC_WITH_EXTERNAL_GEN=
ERAL_ENTITY.getBytes())));<br></span><br>I get the following exception:<br>=
<span style=3D"font-family:monospace"><br>java.io.FileNotFoundException: no=
te.dtd (No such file or directory)</span><br><br>Which means the DTD is not=
ignored and so the XEE vulnerability is still there. Note that XXE attempt=
s in the XSD itself seem to be thwarted.<br><br>I have tried the various ap=
proaches listed on the OWASP XEE cheatsheet (<a href=3D"https://cheatsheets=
eries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html=
" target=3D"_blank">https://cheatsheetseries.owasp.org/cheatsheets/XML_Exte=
rnal_Entity_Prevention_Cheat_Sheet.html</a>) but as far as I can tell, none=
of them work with Xerces2.<br><br>Here is my complete pom.xml for referenc=
e:<br><span style=3D"font-family:monospace"><br><project xmlns=3D"<=
a href=3D"http://maven.apache.org/POM/4.0.0" target=3D"_blank">http://maven=
.apache.org/POM/4.0.0</a>"<br>xmlns:xsi=3D"<a href=3D"http://www.=
w3.org/2001/XMLSchema-instance" target=3D"_blank">http://www.w3.org/2001/XM=
LSchema-instance</a>"<br>=C2=A0 xsi:schemaLocation=3D"<a href=3D"=
http://maven.apache.org/POM/4.0.0" target=3D"_blank">http://maven.apache.or=
g/POM/4.0.0</a><br><a href=3D"http://maven.apache.org/xsd/maven-4.0.0.xsd" =
target=3D"_blank">http://maven.apache.org/xsd/maven-4.0.0.xsd</a>">=
<br>=C2=A0 <modelVersion>4.0.0</modelVersion><br><br>=C2=A0 <=
;groupId>org.leplus.infsec</groupId><br>=C2=A0 <artifactId>x=
ee</artifactId><br>=C2=A0 <version>0.0.1-SNAPSHOT</version&g=
t;<br>=C2=A0 <packaging>jar</packaging><br><br>=C2=A0 <name&=
gt;xee</name><br>=C2=A0 <url><a href=3D"http://maven.apache.org=
" target=3D"_blank">http://maven.apache.org</a></url><br><br>=C2=A0 &=
lt;properties><br>=C2=A0 =C2=A0 <project.build.sourceEncoding>UTF-=
8</project.build.sourceEncoding><br>=C2=A0 </properties><br><br=
>=C2=A0 <dependencies><br>=C2=A0 =C2=A0 <dependency><br>=C2=A0 =
=C2=A0 =C2=A0 <groupId>xalan</groupId><br>=C2=A0 =C2=A0 =C2=A0 =
<artifactId>xalan</artifactId><br>=C2=A0 =C2=A0 =C2=A0 <vers=
ion>2.7.2</version><br>=C2=A0 =C2=A0 =C2=A0 <scope>runtime&l=
t;/scope><br>=C2=A0 =C2=A0 </dependency><br>=C2=A0 =C2=A0 <depe=
ndency><br>=C2=A0 =C2=A0 =C2=A0 <groupId>xerces</groupId><br=
>=C2=A0 =C2=A0 =C2=A0 <artifactId>xercesImpl</artifactId><br>=
=C2=A0 =C2=A0 =C2=A0 <version>2.12.0</version><br>=C2=A0 =C2=A0=
=C2=A0 <scope>runtime</scope><br>=C2=A0 =C2=A0 </dependency=
><br>=C2=A0 =C2=A0 <dependency><br>=C2=A0 =C2=A0 =C2=A0 <groupI=
d>junit</groupId><br>=C2=A0 =C2=A0 =C2=A0 <artifactId>junit&=
lt;/artifactId><br>=C2=A0 =C2=A0 =C2=A0 <version>4.12</version&=
gt;<br>=C2=A0 =C2=A0 =C2=A0 <scope>test</scope><br>=C2=A0 =C2=
=A0 </dependency><br>=C2=A0 </dependencies><br></project>=
</span><br><br>I have also created a GitHub project (<a href=3D"https://git=
hub.com/thomasleplus/xee" target=3D"_blank">https://github.com/thomasleplus=
/xee</a>) with all my source code and JUnit test case if someone want to re=
produce/test the issue. I have also created a GitHub project (<a href=3D"ht=
tps://github.com/thomasleplus/xee" target=3D"_blank">https://github.com/tho=
masleplus/xee</a>) with all my source code and JUnit test case if someone w=
ants to reproduce/test the issue.<br><br>Thank you in advance for any help =
you can provide,<br><br>Tom</div>
--00000000000090b6be05b18ff5c4--