Skip to content

Commit 1c372cd

Browse files
ESS-ENNESS-ENN
committed
documentbuilderfactory-external-parameter-entities-true-java
1 parent 5536878 commit 1c372cd

3 files changed

+31
-0
lines changed

‎rules/java/security/documentbuilderfactory-external-parameter-entities-true-java.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
id: documentbuilderfactory-external-parameter-entities-true-java
2+
severity: warning
3+
language: java
4+
message: >-
5+
External entities are allowed for $DBFACTORY. This is vulnerable to XML
6+
external entity attacks. Disable this by setting the feature
7+
"http://xml.org/sax/features/external-parameter-entities" to false.
8+
note: >-
9+
[CWE-611] Improper Restriction of XML External Entity Reference.
10+
[REFERENCES]
11+
- https://blog.sonarsource.com/secure-xml-processor
12+
rule:
13+
pattern: $DBFACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities",true);

‎tests/__snapshots__/documentbuilderfactory-external-parameter-entities-true-java-snapshot.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
id: documentbuilderfactory-external-parameter-entities-true-java
2+
snapshots:
3+
? |
4+
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities" , true);
5+
spf.setFeature("http://xml.org/sax/features/external-parameter-entities" , true);
6+
: labels:
7+
- source: dbf.setFeature("http://xml.org/sax/features/external-parameter-entities" , true);
8+
style: primary
9+
start: 0
10+
end: 81

‎tests/java/documentbuilderfactory-external-parameter-entities-true-java-test.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
id: documentbuilderfactory-external-parameter-entities-true-java
2+
valid:
3+
- |
4+
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities" , false);
5+
invalid:
6+
- |
7+
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities" , true);
8+
spf.setFeature("http://xml.org/sax/features/external-parameter-entities" , true);

0 commit comments

Comments
 (0)