[BAEL-7652] Fix XXE Vulnerability by creating a SecureDocumentBuilderFactory (#17732)

Co-authored-by: rajatgarg <[email protected]>

Author: rajat-garg

xml/src/main/java/com/baeldung/xml/DefaultParser.java

@@ -1,5 +1,7 @@
 package com.baeldung.xml;
 
+import static com.baeldung.xml.SecureDocumentBuilderFactory.newSecureDocumentBuilderFactory;
+
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
@@ -31,7 +33,7 @@ public NodeList getFirstLevelNodeList() {
         NodeList nodeList = null;
         try {
             FileInputStream fileIS = new FileInputStream(this.getFile());
-            DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance();
+            DocumentBuilderFactory builderFactory = newSecureDocumentBuilderFactory();
 
             DocumentBuilder builder = builderFactory.newDocumentBuilder();
 
@@ -52,7 +54,7 @@ public NodeList getFirstLevelNodeList() {
     public Node getNodeById(String id) {
         Node node = null;
         try {
-            DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance();
+            DocumentBuilderFactory builderFactory = newSecureDocumentBuilderFactory();
 
             DocumentBuilder builder = builderFactory.newDocumentBuilder();
 
@@ -73,7 +75,7 @@ public Node getNodeById(String id) {
     public NodeList getNodeListByTitle(String name) {
         NodeList nodeList = null;
         try {
-            DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance();
+            DocumentBuilderFactory builderFactory = newSecureDocumentBuilderFactory();
 
             DocumentBuilder builder = builderFactory.newDocumentBuilder();
 
@@ -97,7 +99,7 @@ public NodeList getElementsByDate(String date) {
         NodeList nodeList = null;
 
         try {
-            DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance();
+            DocumentBuilderFactory builderFactory = newSecureDocumentBuilderFactory();
 
             DocumentBuilder builder = builderFactory.newDocumentBuilder();
 
@@ -120,7 +122,7 @@ public NodeList getElementsByDate(String date) {
     public NodeList getAllTutorials() {
         NodeList nodeList = null;
         try {
-            DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance();
+            DocumentBuilderFactory builderFactory = newSecureDocumentBuilderFactory();
             builderFactory.setNamespaceAware(true);
             DocumentBuilder builder = builderFactory.newDocumentBuilder();
 

xml/src/main/java/com/baeldung/xml/JaxenDemo.java

@@ -1,5 +1,7 @@
 package com.baeldung.xml;
 
+import static com.baeldung.xml.SecureDocumentBuilderFactory.newSecureDocumentBuilderFactory;
+
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
@@ -26,7 +28,7 @@ public JaxenDemo(File file) {
     public List getAllTutorial() {
         try {
             FileInputStream fileIS = new FileInputStream(this.getFile());
-            DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance();
+            DocumentBuilderFactory builderFactory = newSecureDocumentBuilderFactory();
 
             DocumentBuilder builder = builderFactory.newDocumentBuilder();
 

xml/src/main/java/com/baeldung/xml/SecureDocumentBuilderFactory.java

@@ -0,0 +1,18 @@
+package com.baeldung.xml;
+
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+
+public class SecureDocumentBuilderFactory {
+    public static DocumentBuilderFactory newSecureDocumentBuilderFactory() throws ParserConfigurationException {
+        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+        dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+        dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
+        dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+        dbf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+        dbf.setFeature("http://apache.org/xml/features/dom/create-entity-ref-nodes", false);
+        dbf.setExpandEntityReferences(false);
+        dbf.setFeature("http://javax.xml.XMLConstants/feature/secure-processing", true);
+        return dbf;
+    }
+}