(Sonar) Fixed finding: "XML parsers should not be vulnerable to XXE attacks"

[pixee-standardchartered]

Remediation

This change fixes "XML parsers should not be vulnerable to XXE attacks" (id = java:S2755) identified by Sonar.

Details

This change prevents XML parsing APIs from resolving external entities, which can protect you from arbitrary code execution, sensitive data exfiltration, and probably a bunch more evil things attackers are still discovering.

Without this protection, attackers can cause your parser to retrieve sensitive information with attacks like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<book>
    <title>&xxe;</title>
</book>

Yes, it's pretty insane that this is the default behavior. Our change hardens the factories created with the necessary security features to prevent your parser from resolving external entities.

More reading

• https://cwe.mitre.org/data/definitions/611
• https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
• https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
• https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XXE%20Injection/README.md

I have additional improvements ready for this repo! If you want to see them, leave the comment:

@pixeebot next

... and I will open a new PR right away!

🧚🤖 Powered by Pixeebot

Feedback | Community | Docs | Codemod ID: sonar:java/xxe-2755

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[pixee-standardchartered]

I'm confident in this change, but I'm not a maintainer of this project. Do you see any reason not to merge it?

If this change was not helpful, or you have suggestions for improvements, please let me know!

[pixee-standardchartered]

Just a friendly ping to remind you about this change. If there are concerns about it, we'd love to hear about them!

[pixee-standardchartered]

This change may not be a priority right now, so I'll close it. If there was something I could have done better, please let me know!

You can also customize me to make sure I'm working with you in the way you want.