使用JAXB防止XXE攻击

本文介绍了使用JAXB防止XXE攻击的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！ 问题描述

最近，我们对我们的代码进行了安全审核，其中一个问题是我们的应用程序受到 Xml eXternal Entity （XXE）攻击。

Recently, we had a security audit on our code, and one of the problem is that our application is subject to the Xml eXternal Entity (XXE) attack.

基本上，应用程序是一个通过Web服务以XML形式接收输入的计算器。

Basically, the application is a calculator that receives inputs as XML, through a Web-Service.

以下是此类XXE攻击的示例在我们的申请中：

Here is an example of such an XXE attack on our application:

<soapenv:Envelope xmlns:soapenv="schemas.xmlsoap/soap/envelope/"> <soapenv:Header/> <soapenv:Body> <foo:calculateStuff> <!--Optional:--> <xmlInput><![CDATA[<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <!DOCTYPE currency [ <!ENTITY include SYSTEM "file:///d:/" >]> <calcinput>...</calcinput> ]]></xmlInput> </foo:calculateStuff> </soapenv:Body> </soapenv:Envelope>

如您所见，我们可以引用指向外部文件的实体（file：/// d：/）。

As you can see, we can refer to an entity that points to an external file ("file:///d:/").

关于XML输入本身（ < calcinput> ...< / calcinput> part）使用JAXB（v2.1）进行解组。网络服务部分基于jaxws-rt（2.1）。

Regarding the XML input itself (the <calcinput>...</calcinput> part) is unmarshalled with JAXB (v2.1). The web-service part is based on jaxws-rt (2.1).

我需要做些什么来保护我的网络服务？

What do I need to do to secure my web-service?

推荐答案

JAXB

您可以阻止Xml外部实体（XXE） ）来自 XMLStreamReader 的解组攻击具有 IS_SUPPORTING_EXTERNAL_ENTITIES 和/或 XMLInputFactory.SUPPORT_DTD 属性设置为 false 。

You can prevent the Xml eXternal Entity (XXE) attack by unmarshalling from an XMLStreamReader that has the IS_SUPPORTING_EXTERNAL_ENTITIES and/or XMLInputFactory.SUPPORT_DTD properties set to false.

JAX-WS

JAX-WS实现应该为您解决这个问题。如果不是，我会建议针对特定的implmententation打开一个错误。

A JAX-WS implementation should take care of this for you. If it doesn't I would recommend opening a bug against the specific implmententation.

示例

演示

Demo

package xxe; import javax.xml.bind.*; import javax.xml.stream.*; import javax.xml.transform.stream.StreamSource; public class Demo { public static void main(String[] args) throws Exception { JAXBContext jc = JAXBContext.newInstance(Customer.class); XMLInputFactory xif = XMLInputFactory.newFactory(); xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); xif.setProperty(XMLInputFactory.SUPPORT_DTD, false); XMLStreamReader xsr = xif.createXMLStreamReader(new StreamSource("src/xxe/input.xml")); Unmarshaller unmarshaller = jc.createUnmarshaller(); Customer customer = (Customer) unmarshaller.unmarshal(xsr); Marshaller marshaller = jc.createMarshaller(); marshaller.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, true); marshaller.marshal(customer, System.out); } }

输入.xml

input.xml

此XML文档包含一个实体，该实体已设置为获取我用于创建此示例的文件列表。

This XML document contains an entity that has been setup to get the listing of files I used to create this example.

<?xml version="1.0"?> <!DOCTYPE customer [ <!ENTITY name SYSTEM "/Users/bdoughan/Examples/src/xxe/"> ] > <customer> <name>&name;</name> </customer>

客户

Customer

package xxe; import javax.xml.bind.annotation.XmlRootElement; @XmlRootElement public class Customer { private String name; public String getName() { return name; } public void setName(String name) { this.name = name; } }

输出 - 默认配置

Output - Default Configuration

默认情况下，实体将被解析。

By default the entity will be resolved.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <customer> <name>Customer.java Demo.java input.xml </name> </customer>

输出 XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES 属性设置为 false

设置此属性时实体未解析。

When this property is set the entity is not resolved.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <customer> <name></name> </customer>

XMLInputFactory.SUPPORT_DTD 属性设置为 false

当此属性设置为尝试解析实体时抛出异常。

When this property is set an exception is thrown trying to resolve the entity.

Exception in thread "main" javax.xml.bind.UnmarshalException - with linked exception: [javax.xml.stream.XMLStreamException: ParseError at [row,col]:[8,15] Message: The entity "name" was referenced, but not declared.] at com.sun.xml.bind.v2.runtime.unmarshaller.UnmarshallerImpl.handleStreamException(UnmarshallerImpl.java:436) at com.sun.xml.bind.v2.runtime.unmarshaller.UnmarshallerImpl.unmarshal0(UnmarshallerImpl.java:372) at com.sun.xml.bind.v2.runtime.unmarshaller.UnmarshallerImpl.unmarshal(UnmarshallerImpl.java:342) at xxe.Demo.main(Demo.java:18) Caused by: javax.xml.stream.XMLStreamException: ParseError at [row,col]:[8,15] Message: The entity "name" was referenced, but not declared. at com.sun.apache.xerces.internal.impl.XMLStreamReaderImpl.next(XMLStreamReaderImpl.java:598) at com.sun.xml.bind.v2.runtime.unmarshaller.StAXStreamConnector.bridge(StAXStreamConnector.java:196) at com.sun.xml.bind.v2.runtime.unmarshaller.UnmarshallerImpl.unmarshal0(UnmarshallerImpl.java:370) ... 2 more