From a6ae74e7941de83e7bf3b59ebb0653bfeb7b0682 Mon Sep 17 00:00:00 2001 From: Dario Ghunney Ware Date: Fri, 19 Dec 2025 17:08:12 +0000 Subject: [PATCH] Addressing XML vulnerability --- .../security/saml2/Saml2Configuration.java | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/saml2/Saml2Configuration.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/saml2/Saml2Configuration.java index 57fdad8041..e7ab748ed5 100644 --- a/app/proprietary/src/main/java/stirling/software/proprietary/security/saml2/Saml2Configuration.java +++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/saml2/Saml2Configuration.java @@ -255,13 +255,18 @@ public class Saml2Configuration { try (InputStream metadataStream = samlConf.getIdpMetadataUri()) { DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); factory.setNamespaceAware(true); + + // XXE prevention - disable all external entities and DTD processing factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); - try { - factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); - factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); - } catch (IllegalArgumentException ignored) { - log.debug("XML parser does not support external entity restrictions"); - } + factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); + factory.setFeature("http://xml.org/sax/features/external-general-entities", false); + factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + factory.setFeature( + "http://apache.org/xml/features/nonvalidating/load-external-dtd", false); + factory.setXIncludeAware(false); + factory.setExpandEntityReferences(false); + factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); + factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); DocumentBuilder builder = factory.newDocumentBuilder(); Document doc = builder.parse(metadataStream);