I want to prevent a XXE attack in my project. It's old api project which runs on java 7 (no maven) and jboss-as-7 server. But during the execution i get the error: org.xml.sax.SAXNotRecognizedException: Property 'http://javax.xml.XMLConstants/property/accessExternalDTD' is not recognized.
org.xml.sax.SAXNotRecognizedException: Property 'http://javax.xml.XMLConstants/property/accessExternalDTD' is not recognized.
15:19:02,845 ERROR [stderr] (http-localhost-127.0.0.1-8080-3) at org.apache.xerces.jaxp.validation.ValidatorImpl.setProperty(ValidatorImpl.java:218)
15:19:02,846 ERROR [stderr] (http-localhost-127.0.0.1-8080-3) at com.uid.kua.web.KUARestController.authenticateAtAUA(KUARestController.java:118)
15:19:02,847 ERROR [stderr] (http-localhost-127.0.0.1-8080-3) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
15:19:02,847 ERROR [stderr] (http-localhost-127.0.0.1-8080-3) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
15:19:02,848 ERROR [stderr] (http-localhost-127.0.0.1-8080-3) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
15:19:02,849 ERROR [stderr] (http-localhost-127.0.0.1-8080-3) at java.lang.reflect.Method.invoke(Method.java:606)
I have searched about it and every forum has some different meaning to it saying it's a bug. I have not found any relevant solution for this exception. Please help. Thanks in advance.
Finally i resolved it. I am posting the answer in case this helps anyone. After going through online solutions i was unable to detect the main issue which was causing the above error. For xxe prevention we need some defined properties like: XMLConstants.ACCESS_EXTERNAL_DTD XMLConstants.ACCESS_EXTERNAL_SCHEMA
We need xerces and jaxp-api jars to pasrse xml and prevent xxe provided by the api's to resolve the xml by setting some above properties. Prior to JDK 7 these are already included in JDK 7 and above. So we don't need to import above jars in our project classpath.
In my case i was using jboss-as-7.1.1.Final as application server which also has it's own xerces jar (org.apache.xerces.). But java also comes with it's own xerces and jaxp implementation (com.sun.xerces.). So while deploying the war we get the above error as both these jars conflicts with each other where jboss loads it's own xerces jars.
Solution: We need to exclude the jboss xerces implementation by making changes in jboss/org/apache/xerces/main/modules.xml file. Comment out the lines as shown below:
> <module xmlns="urn:jboss:module:1.1" name="org.apache.xerces">
> <!--
> <resources>
> <resource-root path="xercesImpl-2.9.1-jbossas-1.jar"/>
> Insert resources here
> </resources>
> -->
> <dependencies>
> <module name="javax.api"/>
> </dependencies>
>
> </module>
Now deploy and run your application. Happy coding.