[AXIS2-5877] XML External Entity Injections

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Incomplete
• Affects Version/s: 1.7.6
• Component/s: jaxws
• Labels: security
• Flags: Important
• Assignee: Unassigned
• Reporter: Donald Kwakkel
• Created: 05/Sep/17 12:03
• Updated: 09/Mar/21 20:41
• Resolved: 09/Mar/21 20:41

Description

XML parser configured in ConvertUtils.java:225 does not prevent nor limit external entities resolution. This can expose the parser to an XML External Entities attack.

Proposed fix: Enable where TransformerFactory is used always the secure processing feature:

	public static TransformerFactory createTransformerFactory() {
		TransformerFactory factory = TransformerFactory.newInstance();
		try {
			factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
		}
		catch (TransformerConfigurationException e) {
			throw new IllegalStateException(e);
		}
		return factory;
	}

Also in XSLTTemplateProcessor.java:147 (XSLT Injection) and other locations where this and DocumentBuilderFactory is handled wrong. See attached screenshots.