javainputstreamcheckmarxxmlstreamreaderxxe

XMLStreamReader / InputStream xxe vulnerability showing up in Checkmarx report

These lines of code are causing an xxe vulnerability to show up in a Checkmarx report:

InputStream is = connection.getInputStream();

XMLInputFactory factory = XMLInputFactory.newInstance();
XMLStreamReader reader = factory.createXMLStreamReader(is);

The issue states that:

"The application sends a request to a remote server, for some resource, using createXMLStreamReader. However, an attacker can control the target of the request, by sending a URL or other data in getInputStream."

Any ideas how to resolve this?

Solution

  • Found answer that worked for me here; add these properties to the XMLInputFactory: 

    XMLInputFactory xif = XMLInputFactory.newFactory();

//prevents using external resources when parsing xml
xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);

//prevents using external document type definition when parsing xml
xif.setProperty(XMLInputFactory.SUPPORT_DTD, false);