Solve security issue parsing xml using SAX parser

Question

I have an android app, in which user can enter any xml source url to parse. My app then parses the xml(if valid) and displays results.

The issue is, if the user enters an untrusted xml source url, the app and/or the device might be effected.

What are the best ways to identify risk and prevent exploit.

With my research I found that enabling FEATURE_SECURE_PROCESSING and disabling expansion might help. But can anyone tell me what it is, and how do I achieve it.

Thanks.

Do you use a schema to validate the XML content?

user849425
– user849425

2012-05-31 17:34:00 +00:00
Commented May 31, 2012 at 17:34 — user849425
– user849425, Commented May 31, 2012 at 17:34

dcanh121 · Accepted Answer · 2012-05-31 18:01:39Z

6

After researching, I found this. I hope this would solve my problem.

To enable FEATURE_SECURE_PROCESSING

SAXParserFactory spf = SAXParserFactory.newInstance();
spf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

Disable DTDs

spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

answered May 31, 2012 at 18:01

dcanh121

4,69011 gold badges42 silver badges84 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

digitizedx Over a year ago

Did this actually work? I am getting an exception when doing this.

Arpit Garg Over a year ago

@digitizedx Were you able to get out of exception. I am getting javax.xml.parsers.ParserConfigurationException: apache.org/xml/features/disallow-doctype-decl

digitizedx Over a year ago

@ArpitGarg. No. OWASP suggest some alternatives. So I just followed owasp.org/index.php/…

Pierre Ernst · Accepted Answer · 2012-06-01 13:17:23Z

2

For SAX and DOM parsers, disallowing DTD should be sufficient as dcanh121 noted.

factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
For StAX parser:

factory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, false);

answered Jun 1, 2012 at 13:17

Pierre Ernst

5243 silver badges7 bronze badges

Collectives™ on Stack Overflow

Solve security issue parsing xml using SAX parser

2 Answers 2

3 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related