Strengthen the fix for XML Injection Entity Injection

Question

When I scan using the fortify tool, I had some problems in the section "Embedding the XML of an external object".

TransformerFactory trfactory = TransformerFactory.newInstance(); 

This is the place where the error is displayed. I gave the following fix suggested by fortify

 trfactory.setFeature("http://xml.org/sax/features/external-general-entities", false); trfactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); 

but still the problems are not resolved. How to fix this problem?

Answer 1

 TransformerFactory trfactory = TransformerFactory.newInstance(); trfactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); trfactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); trfactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); 

That would be enough.

Answer 2

I tried using the implementation class "Xalan" instead of TransformerFactory.newInstance (). It worked for me, and the fix was fixed.

  TransformerFactoryImpl transformerFactoryImpl = new TransformerFactoryImpl(); Transformer transformer = transformerFactoryImpl.newTransformer(); 

Answer 3

Sometimes it will not work if the java version is incompatible.

 if (javaVersion > 1.6) { dbf.setFeature("http://xml.org/sax/features/external-general-entities", false); dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false); } else { if (javaVersion > 1.5) { dbf.setFeature("http://xerces.apache.org/xerces2-j/features.html#external-general-entities", false); dbf.setFeature("http://xerces.apache.org/xerces2-j/features.html#external-parameter-entities", false); } else { dbf.setFeature("http://xerces.apache.org/xerces-j/features.html#external-general-entities", false); dbf.setFeature("http://xerces.apache.org/xerces-j/features.html#external-parameter-entities", false); } } 

This worked for me :-)

Answer 4

You can also try:

  TransformerFactoryImpl transformerFactoryImpl = new TransformerFactoryImpl(); Transformer transformer = transformerFactoryImpl.newTransformer(); transformer.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);