Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

[BRMO-384] Fix Resolving XML external entity in user-controlled data #2310

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mprins merged 7 commits into from
Nov 19, 2024
Merged

[BRMO-384] Fix Resolving XML external entity in user-controlled data #2310

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
dd2bf86
Fix code scanning alert no. 1431: Resolving XML external entity in us…
mprins Nov 18, 2024
a08ff3c
Fix code scanning alert no. 1430: Resolving XML external entity in us…
mprins Nov 18, 2024
16cc62f
Fix code scanning alert no. 1429: Resolving XML external entity in us…
mprins Nov 18, 2024
192be99
Fix code scanning alert no. 1428: Resolving XML external entity in us…
mprins Nov 18, 2024
bb9f701
Fix code scanning alert no. 1426: Resolving XML external entity in us…
mprins Nov 18, 2024
7c55a81
Fix code scanning alert no. 1425: Resolving XML external entity in us…
mprins Nov 18, 2024
248e70f
fixup
mprins Nov 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions 3 brmo-loader/src/main/java/nl/b3p/brmo/loader/xml/BRPXMLReader.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,9 @@ public void init() throws Exception {
soort = BrmoFramework.BR_BRP;
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setNamespaceAware(true);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(in);

Expand Down
5 changes: 4 additions & 1 deletion 5 brmo-loader/src/main/java/nl/b3p/brmo/loader/xml/Brk2SnapshotXMLReader.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@
*/
public class Brk2SnapshotXMLReader extends BrmoXMLReader {
private static final Log log = LogFactory.getLog(Brk2SnapshotXMLReader.class);
private final XMLInputFactory factory = XMLInputFactory.newInstance();
private final XMLInputFactory factory;
private final XMLStreamReader streamReader;
private final Transformer transformer;
private static final String KAD_OBJ_SNAP = "KadastraalObjectSnapshot";
Expand Down Expand Up @@ -59,6 +59,9 @@ private static class MutatieGegevens {
public Brk2SnapshotXMLReader(InputStream in)
throws XMLStreamException, TransformerConfigurationException {

factory = XMLInputFactory.newInstance();
factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
factory.setProperty("javax.xml.stream.isSupportingExternalEntities", false);
streamReader = factory.createXMLStreamReader(in);
TransformerFactory tf = TransformerFactory.newInstance();
transformer = tf.newTransformer();
Expand Down
5 changes: 4 additions & 1 deletion 5 brmo-loader/src/main/java/nl/b3p/brmo/loader/xml/BrkSnapshotXMLReader.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ public class BrkSnapshotXMLReader extends BrmoXMLReader {

private static final Log log = LogFactory.getLog(BrkSnapshotXMLReader.class);

private final XMLInputFactory factory = XMLInputFactory.newInstance();
private final XMLInputFactory factory;
private final XMLStreamReader streamReader;
private final Transformer transformer;

Expand Down Expand Up @@ -56,6 +56,9 @@ private static class MutatieGegevens {
public BrkSnapshotXMLReader(InputStream in)
throws XMLStreamException, TransformerConfigurationException {

factory = XMLInputFactory.newInstance();
factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
factory.setProperty("javax.xml.stream.isSupportingExternalEntities", false);
streamReader = factory.createXMLStreamReader(in);
TransformerFactory tf = TransformerFactory.newInstance();
transformer = tf.newTransformer();
Expand Down
5 changes: 4 additions & 1 deletion 5 brmo-loader/src/main/java/nl/b3p/brmo/loader/xml/GbavXMLReader.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ public class GbavXMLReader extends BrmoXMLReader {
private static final Log log = LogFactory.getLog(GbavXMLReader.class);
private static final String PERSOON = "persoon";
public static final String PREFIX = "NL.BRP.Persoon.";
private final XMLInputFactory factory = XMLInputFactory.newInstance();
private final XMLInputFactory factory;
private final XMLStreamReader streamReader;
private final Transformer transformer;
private final XMLOutputFactory xmlof;
Expand All @@ -52,6 +52,9 @@ public class GbavXMLReader extends BrmoXMLReader {

public GbavXMLReader(InputStream in)
throws XMLStreamException, TransformerConfigurationException {
factory = XMLInputFactory.newInstance();
factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
factory.setProperty("javax.xml.stream.isSupportingExternalEntities", false);
streamReader = factory.createXMLStreamReader(in);
TransformerFactory tf = TransformerFactory.newInstance();
transformer = tf.newTransformer();
Expand Down
7 changes: 6 additions & 1 deletion 7 brmo-loader/src/main/java/nl/b3p/brmo/loader/xml/NhrXMLReader.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
import java.util.HashMap;
import java.util.Iterator;
import java.util.Map;
import javax.xml.XMLConstants;
import javax.xml.bind.JAXBContext;
import javax.xml.bind.Unmarshaller;
import javax.xml.parsers.DocumentBuilder;
Expand Down Expand Up @@ -60,7 +61,11 @@ public NhrXMLReader(InputStream in) throws Exception {

// Split input naar multiple berichten
DOMResult r = new DOMResult();
splitTemplates.newTransformer().transform(new StreamSource(in), r);
Transformer transformer=splitTemplates.newTransformer();
StreamSource source = new StreamSource(in);
// Prevent external entity resolution
source.setSystemId("");
transformer.transform(source, r);

Check failure

Code scanning / CodeQL

Resolving XML external entity in user-controlled data

XML parsing depends on a [user-provided value](1) without guarding against external entity expansion.

Copilot Autofix

AI over 1 year ago

Copilot could not generate an autofix suggestion

Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.


JAXBContext jc = JAXBContext.newInstance(NhrBerichten.class, NhrBericht.class, Bericht.class);
Unmarshaller unmarshaller = jc.createUnmarshaller();
Expand Down
3 changes: 3 additions & 0 deletions 3 brmo-loader/src/main/java/nl/b3p/brmo/loader/xml/WozXMLReader.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,9 @@ public void init() throws Exception {

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setNamespaceAware(true);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(in);

Expand Down
Morty Proxy This is a proxified and sanitized view of the page, visit original site.