Prevent XXE fortify issue for TrasnformerFactory

Question

I need to fix XXE issue .I am using transformerfactory in code. Found below fix but i can not see ACCESS_EXTERNAL_DTD attribute in my code.Reason which i got is below code will work for Java7 however i am using Java 6 .Can some one please suggest some other fix To protect a Java TransformerFactory from XXE, do this:

TransformerFactory tf = TransformerFactory.newInstance();
tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");

DId u get any solution for java 6 Please share if possible – Laxminarayana Challagonda Apr 03 '17 at 11:58 — Laxminarayana Challagonda, Apr 03 '17 at 11:58

score 0 · Answer 1 · edited May 23 '17 at 12:32

I was in to same situation and it is difficult to resolve without updating Java version.

Following is code change that was able to pass fortify scan with same results.

Instead of using TransformerFactory use following code:

   DOMImplementationLS domImplementation = (DOMImplementationLS) doc.getImplementation();
   LSSerializer lsSerializer = domImplementation.createLSSerializer();
   LSOutput lsOutput = domImplementation.createLSOutput( );


   lsOutput.setEncoding("UTF-8");
   StringWriter stringWriter=new StringWriter();
   lsOutput.setCharacterStream(stringWriter);
   lsSerializer.write(doc,lsOutput);
   return stringWriter.toString();

For reference please review Is there a more elegant way to convert an XML Document to a String in Java than this code?.

And

Prevent XXE fortify issue for TrasnformerFactory

1 Answers1

Linked