Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disable DTD and external entities support in XmlEventDecoder to prevent XXE and XML bomb attack [SPR-15797] #20352

Closed
spring-issuemaster opened this issue Jul 20, 2017 · 2 comments

Comments

@spring-issuemaster
Copy link
Collaborator

commented Jul 20, 2017

Takuya Iwatsuka opened SPR-15797 and commented

An instance of XMLInputFactory in XmlEventDecoder supports DTD and external entities.
Because Jaxb2XMLDecoder uses XMLEventDecoder, this could be exploited to some kind of attack like XXE or XML Bomb.
To prevent these attacks, it should disable support DTD and external entities by setting properties of XMLInputFactory.


Affects: 5.0 RC2

Issue Links:

  • #17727 XML input vulnerability based on DTD declaration

Referenced from: commits e4651d6

@spring-issuemaster

This comment has been minimized.

Copy link
Collaborator Author

commented Jul 20, 2017

Juergen Hoeller commented

We have a common setup for a defensive XMLInputFactory already, so I've taken the opportunity to factor it out to StaxUtils and reuse it in XmlEventDecoder now.

Thanks for raising this - just in time for 5.0 RC3!

@spring-issuemaster

This comment has been minimized.

Copy link
Collaborator Author

commented Jul 20, 2017

Takuya Iwatsuka commented

Thank you for the quick response.
I'm looking forward to the next release!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
2 participants
You can’t perform that action at this time.