- 필수 기능
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- 디지털 경험
- 소프트웨어 제공
- 보안
- 로그 관리
- 관리
- 인프라스트럭처
- ci
- containers
- csm
- ndm
- otel_guides
- overview
- slos
- synthetics
- tests
- 워크플로
ID: java-security/xml-parsing-xee
Language: Java
Severity: Notice
Category: Security
Systems may be vulnerable to an XML External Entity attack when they process XML from untrusted sources.
public class TestClass {
public void parseXML(InputStream input) throws XMLStreamException {
XMLInputFactory factory = XMLInputFactory.newFactory();
factory.setProperty("aproperty", false);
XMLStreamReader reader = factory.createXMLStreamReader(input);
factory.setProperty("anotherproperty", false);
}
}
public class TestClass {
public void parseXML(InputStream input) throws XMLStreamException {
XMLInputFactory factory = XMLInputFactory.newFactory();
factory.setProperty("aproperty", false);
factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
factory.setProperty("anotherproperty", false);
XMLStreamReader reader = factory.createXMLStreamReader(input);
}
}
public class TestClass {
public void parseXML(InputStream input) throws XMLStreamException {
XMLInputFactory factory = XMLInputFactory.newFactory();
factory.setProperty("aproperty", false);
factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
factory.setProperty("anotherproperty", false);
XMLStreamReader reader = factory.createXMLStreamReader(input);
}
}