whether xxe and billion laughs is possible using xmlpullfactory?I have tried below xml code
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE author [
<!ELEMENT author (#PCDATA)>
<!ENTITY js "Jo Smith">
]>
<author>&js;</author>
parsed above xml file using below java code used kxml2-2.3.0.jar
try
{
XmlPullParserFactory factory =XmlPullParserFactory.newInstance();
XmlPullParser parser = factory.newPullParser();
File file=new File("index.xml");
FileReader fileReader = new FileReader(file);
BufferedReader bufferedReader = new BufferedReader(fileReader);
StringBuffer stringBuffer = new StringBuffer();
String line;
while ((line = bufferedReader.readLine()) != null) {
stringBuffer.append(line);
stringBuffer.append("\n");
}
fileReader.close();
parser.setFeature(XmlPullParser.FEATURE_PROCESS_NAMESPACES,true);
parser.setInput( new StringReader(stringBuffer.toString()) );
while (true) {
int event = parser.nextToken();
if (event == XmlPullParser.START_TAG) {
System.out.println("Start-tag: " + parser.getName()) ;
}
else if (event == XmlPullParser.END_TAG) {
System.out.println("End-tag: " + parser.getName());
}
else if (event == XmlPullParser.START_DOCUMENT) {
System.out.println("Start document: " +
parser.getText());
}
else if (event == XmlPullParser.TEXT) {
System.out.println("Text: " + parser.getText());
}
else if (event == XmlPullParser.CDSECT) {
System.out.println("CDATA Section: " +
parser.getText());
}
else if (event == XmlPullParser.COMMENT) {
System.out.println("Comment: " + parser.getText());
}
else if (event == XmlPullParser.DOCDECL) {
System.out.println("Document type declaration: " +
parser.getText());
}
else if (event == XmlPullParser.ENTITY_REF) {
System.out.println("Entity Reference: " +
parser.getName());
System.out.println("Entity Reference value: " +
parser.getText());
}
else if (event == XmlPullParser.IGNORABLE_WHITESPACE) {
System.out.println("Ignorable white space: " +
parser.getText());
}
else if (event == XmlPullParser.PROCESSING_INSTRUCTION)
{
System.out.println("Processing Instruction: " +
parser.getText());
}
else if (event == XmlPullParser.END_DOCUMENT) {
System.out.println("End Document: " +
parser.getText());
break;
} // end else if
} // end while
}
catch(Exception e)
{
e.printStackTrace();
}
GOT OUTPUT AS
Ignorable white space:
Document type declaration:
author [
<!ELEMENT author (#PCDATA)>
<!ENTITY js "Jo Smith">
]
Ignorable white space: Start-tag: author
Entity Reference: js
Entity Reference value: null
End-tag: author Ignorable white space:
End Document: null
But I would like to get entity reference value as josmith.what will be the problem?
