By default XML processors attempt to load all XML schemas and DTD (their locations are defined with xsi:schemaLocation
attributes and
DOCTYPE
declarations), potentially from an external storage such as file system or network, which may lead, if no restrictions are put in
place, to server-side request forgery (SSRF) vulnerabilities.
For DocumentBuilder, SAXParser and Schema JAPX factories:
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); factory.setValidating(true); // Noncompliant factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", true); // Noncompliant SAXParserFactory factory = SAXParserFactory.newInstance(); factory.setValidating(true); // Noncompliant factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", true); // Noncompliant SchemaFactory schemaFactory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); schemaFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", true); // Noncompliant
For Dom4j library:
SAXReader xmlReader = new SAXReader(); // Noncompliant xmlReader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", true); // Noncompliant
For Jdom2 library:
SAXBuilder builder = new SAXBuilder(); builder.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", true); // Noncompliant
For DocumentBuilder, SAXParser and Schema JAPX factories:
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); SAXParserFactory factory = SAXParserFactory.newInstance(); factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); SchemaFactory schemaFactory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); schemaFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
For Dom4j library:
SAXReader xmlReader = new SAXReader(); // Noncompliant xmlReader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
For Jdom2 library:
SAXBuilder builder = new SAXBuilder(); builder.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
This rules does not raise an issue when an EntityResolver
is set.
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); factory.setValidating(true); DocumentBuilder builder = factory.newDocumentBuilder(); builder.setEntityResolver(new MyEntityResolver()); SAXBuilder builder = new SAXBuilder(); builder.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", true); builder.setEntityResolver(new EntityResolver());