Fortify fix for XML External Entity Injection

Question

When I do scan using fortify tool, I got some issues under "XML External Entity Injection".

TransformerFactory trfactory = TransformerFactory.newInstance();

This is the place where it is showing error. I have given the below fix as suggested by fortify

trfactory.setFeature("http://xml.org/sax/features/external-general-entities", false); 
trfactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

but still the issues are not fixed. How to fix this issue?

Kondal Kolipaka · Answer 1 · 2017-08-04T09:58:50.700

4

TransformerFactory trfactory = TransformerFactory.newInstance();
trfactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
trfactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
trfactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");

This would be sufficient.

edited Aug 04 '17 at 09:58

answered Aug 04 '17 at 09:48

Kondal Kolipaka

3,471
22
28

This worked for me, thanks ): . Before this, I tried the solution suggested by Fortify and that didn't worked. – Alessandro Iudicone Aug 21 '19 at 11:47
@AlessandroIudicone Link to the solution suggested by Fortify please! – Lyuboslav Feb 03 '20 at 10:17

score 1 · Answer 2 · answered Sep 17 '16 at 10:45

1

Sometime it will not work if java version is not compatible.

if (javaVersion > 1.6) {
        dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
        dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
      }
else {
        if (javaVersion > 1.5) {
          dbf.setFeature("http://xerces.apache.org/xerces2-j/features.html#external-general-entities", false);
          dbf.setFeature("http://xerces.apache.org/xerces2-j/features.html#external-parameter-entities", false);
        }
else {
          dbf.setFeature("http://xerces.apache.org/xerces-j/features.html#external-general-entities", false);
          dbf.setFeature("http://xerces.apache.org/xerces-j/features.html#external-parameter-entities", false);
        }
 }

It worked for me :-)

answered Sep 17 '16 at 10:45

Prathamesh Ketgale

407
2
8

is it working ? do we need to fix for Transformer or Document Builder Factory As part of security fortify issue?? – Laxminarayana Challagonda Jan 09 '17 at 11:23
1

yes it is working.The providing fixes are wrt the place where it is showing error in fortify tool, in my case I fix it for Document Builder Factory @lax – Prathamesh Ketgale Jan 10 '17 at 10:25
encode for sql from esapi might be the correct fix for this issue – Aditya Yada Jul 29 '19 at 05:58

score 0 · Answer 3 · answered Jul 14 '16 at 15:43

I tried with "Xalan" implementation class instead of TransformerFactory.newInstance().It worked for me and fortify issue got fixed

        TransformerFactoryImpl transformerFactoryImpl = new TransformerFactoryImpl();
        Transformer transformer = transformerFactoryImpl.newTransformer();

score 0 · Answer 4 · answered Sep 23 '16 at 10:46

0

You can also try:

    TransformerFactoryImpl transformerFactoryImpl = new TransformerFactoryImpl();
    Transformer transformer = transformerFactoryImpl.newTransformer();
    transformer.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

answered Sep 23 '16 at 10:46

Ben Wong

1
1

is it working ? do we need to fix for Transformer or Document Builder Factory As part of security fortify issue?? – Laxminarayana Challagonda Jan 09 '17 at 11:21

score 0 · Answer 5 · edited Feb 24 '20 at 07:38

0

Add this line. It worked for me.

factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

edited Feb 24 '20 at 07:38

Maximouse

4,170
1
14
28

answered Feb 24 '20 at 07:28

Abhishek Das

1

this will throw an exception instead of processing a request whenever you include doctype – jitendra varshney Jul 15 '20 at 09:14

Fortify fix for XML External Entity Injection

5 Answers5