An XML External Entity or XSLT External Entity (XXE) vulnerability can occur when a javax.xml.transform.Transformer
is created without
enabling "Secure Processing" or when one is created without disabling resolving of both external DTDs and DTD entities. If that external data is being
controlled by an attacker it may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the
perspective of the machine where the parser is located, and other system impacts.
This rule raises an issue when a Transformer
is created without either of these settings.
Transformer transformer = TransformerFactory.newInstance().newTransformer(); transformer.transform(input, result);
Recommended:
TransformerFactory factory = TransformerFactory.newInstance(); factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); Transformer transformer = factory.newTransformer(); transformer.transform(input, result);
Implementation dependent:
TransformerFactory factory = TransformerFactory.newInstance(); factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); Transformer transformer = factory.newTransformer(); transformer.transform(input, result);
This rule is deprecated; use {rule:java:S2755} instead.