Fortify fix for XML External Entity Injection

Question

When I do scan using fortify tool, I got some issues under "XML External Entity Injection".

TransformerFactory trfactory = TransformerFactory.newInstance(); 

This is the place where it is showing error. I have given the below fix as suggested by fortify

trfactory.setFeature("http://xml.org/sax/features/external-general-entities", false); 
trfactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); 

but still the issues are not fixed. How to fix this issue?

Urolith

Please share any suggestions. – Urolith

Answer 1

TransformerFactory trfactory = TransformerFactory.newInstance();
trfactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
trfactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
trfactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");

This would be sufficient.

Spirula

This worked for me, thanks ): . Before this, I tried the solution suggested by Fortify and that didn't worked. – Casi

@AlessandroIudicone Link to the solution suggested by Fortify please! – Mammoth

Answer 2

Sometime it will not work if java version is not compatible.

if (javaVersion > 1.6) {
        dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
        dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
      }
else {
        if (javaVersion > 1.5) {
          dbf.setFeature("http://xerces.apache.org/xerces2-j/features.html#external-general-entities", false);
          dbf.setFeature("http://xerces.apache.org/xerces2-j/features.html#external-parameter-entities", false);
        }
else {
          dbf.setFeature("http://xerces.apache.org/xerces-j/features.html#external-general-entities", false);
          dbf.setFeature("http://xerces.apache.org/xerces-j/features.html#external-parameter-entities", false);
        }
 }

It worked for me :-)

Hypophyge

is it working ? do we need to fix for Transformer or Document Builder Factory As part of security fortify issue?? – Sawn

yes it is working.The providing fixes are wrt the place where it is showing error in fortify tool, in my case I fix it for Document Builder Factory @lax – Hypophyge

encode for sql from esapi might be the correct fix for this issue – Stonemason

Answer 3

I tried with "Xalan" implementation class instead of TransformerFactory.newInstance().It worked for me and fortify issue got fixed

        TransformerFactoryImpl transformerFactoryImpl = new TransformerFactoryImpl();
        Transformer transformer = transformerFactoryImpl.newTransformer();

Urolith

Answer 4

You can also try:

    TransformerFactoryImpl transformerFactoryImpl = new TransformerFactoryImpl();
    Transformer transformer = transformerFactoryImpl.newTransformer();
    transformer.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

Manual

is it working ? do we need to fix for Transformer or Document Builder Factory As part of security fortify issue?? – Sawn

Answer 5

Add this line. It worked for me.

factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

Wittie

this will throw an exception instead of processing a request whenever you include doctype – Goodrow