haeaeae/Stirling-PDF
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Addressing XML vulnerability

Browse Source
This commit is contained in:
Dario Ghunney Ware
2026-01-26 11:07:38 +00:00
parent 50ec2d82d4
commit a6ae74e794
1 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/proprietary/src/main/java/stirling/software/proprietary/security/saml2/Saml2Configuration.java
+11 -6
View File
@@ -255,13 +255,18 @@ public class Saml2Configuration {
try (InputStream metadataStream = samlConf.getIdpMetadataUri()) {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setNamespaceAware(true);
// XXE prevention - disable all external entities and DTD processing
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
try {
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
} catch (IllegalArgumentException ignored) {
log.debug("XML parser does not support external entity restrictions");
}
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature(
"http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setXIncludeAware(false);
factory.setExpandEntityReferences(false);
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(metadataStream);