XML parsing vulnerable to XEE This product is not supported for your selected
Datadog site . (
).
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter .
TRY THIS RULE ID: java-security/xml-parsing-xee
Language: Java
Severity: Notice
Category: Security
CWE : 611
Description Systems may be vulnerable to an XML External Entity attack when they process XML from untrusted sources.
Learn More Non-Compliant Code Examples public class TestClass {
public void parseXML ( InputStream input ) throws XMLStreamException {
XMLInputFactory factory = XMLInputFactory . newFactory ();
factory . setProperty ( "aproperty" , false );
XMLStreamReader reader = factory . createXMLStreamReader ( input );
factory . setProperty ( "anotherproperty" , false );
}
}
Compliant Code Examples public class TestClass {
public void parseXML ( InputStream input ) throws XMLStreamException {
XMLInputFactory factory = XMLInputFactory . newFactory ();
factory . setProperty ( "aproperty" , false );
factory . setProperty ( XMLInputFactory . SUPPORT_DTD , false );
factory . setProperty ( "anotherproperty" , false );
XMLStreamReader reader = factory . createXMLStreamReader ( input );
}
}
public class TestClass {
public void parseXML ( InputStream input ) throws XMLStreamException {
XMLInputFactory factory = XMLInputFactory . newFactory ();
factory . setProperty ( "aproperty" , false );
factory . setProperty ( XMLInputFactory . IS_SUPPORTING_EXTERNAL_ENTITIES , false );
factory . setProperty ( "anotherproperty" , false );
XMLStreamReader reader = factory . createXMLStreamReader ( input );
}
}
Seamless integrations. Try Datadog Code Security
