XXE in apikit

[prodigysml]

While reading the code in the apikit project we (@n33dle and I) identified a vulnerability we wanted to raise. The vulnerability is an XXE vulnerability (https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing) and can be identified in the lines of code below:

apikit/mule-module-apikit/src/main/java/org/mule/module/apikit/validation/RestXmlSchemaValidator.java

Lines 150 to 158 in 8b38394

	DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
	setFeatures(factory);
	factory.setNamespaceAware(true);
	try
	{
	DocumentBuilder builder = factory.newDocumentBuilder();
	//Setting error handler to null to avoid logs generated by the parser.
	builder.setErrorHandler(null);
	return builder.parse(source);

[juanchib]

The attack is prevented at setFeatures() method, tests for this are found at org.mule.module.apikit.schema.XxeAttackTestCase , thanks for the adivse.