我針對 sonarqube 運行我的 java 代碼，我得到了“禁用 XML 外部實體 (XXE) 處理”作為漏洞。我花了一些時間在谷歌上解決這個問題。我一直在嘗試很多方法，但沒有任何方法適合我。我不知道我錯過了什么我的代碼： final DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance(); docFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); docFactory.setFeature(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); docFactory.setFeature(XMLInputFactory.SUPPORT_DTD, false); docFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); docFactory.setFeature("http://xml.org/sax/features/external-general-entities", false); docFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); docFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); final DocumentBuilder docBuilder = docFactory.newDocumentBuilder(); final Document doc = docBuilder.parse(filepath);我正在使用 java 1.8，感謝任何幫助。謝謝
4 回答
慕少森
TA貢獻2019條經驗 獲得超9個贊
我最終添加了以下所有屬性，以避免 Sonar 抱怨此漏洞：
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
//REDHAT
//https://www.blackhat.com/docs/us-15/materials/us-15-Wang-FileCry-The-New-Age-Of-XXE-java-wp.pdf
factory.setAttribute(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
//OWASP
//https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
// Disable external DTDs as well
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
// and these as well, per Timothy Morgan's 2014 paper: "XML Schema, DTD, and Entity Attacks"
factory.setXIncludeAware(false);
factory.setExpandEntityReferences(false);
DocumentBuilder builder = factory.newDocumentBuilder();
繁星coding
TA貢獻1797條經驗 獲得超4個贊
Java 9+ 解決方案：
對我來說，更改DocumentBuilderFactory.newInstance()為DocumentBuilderFactory.newDefaultInstance()足以消除此警告。
滄海一幻覺
TA貢獻1824條經驗 獲得超5個贊
只需設置這兩個屬性就足夠了：
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
犯罪嫌疑人X
TA貢獻2080條經驗 獲得超4個贊
我通過添加以下代碼片段解決了這個問題：
saxParserFactory = SAXParserFactory.newInstance();
saxParserFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
saxParserFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
saxParserFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
saxParserFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
saxParserFactory.setXIncludeAware(false);
添加回答
舉報
0/150
提交
取消