lsm/weixin-java-tools
1
0
Fork 0
mirror of https://gitee.com/binary/weixin-java-tools.git synced 2025-04-05 17:38:05 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

#903 disable DOCTYPE to fix XXE Vulnerability

Browse Source
This commit is contained in:
Binary Wang 2019-01-10 18:28:55 +08:00
parent d6923f2537
commit 8ec61d1328
4 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
weixin-java-common/src/main/java/me/chanjar/weixin/common/util/crypto/WxCryptUtil.java
View File

@ -39,6 +39,7 @@ public class WxCryptUtil {
try {
final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setExpandEntityReferences(false);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
return factory.newDocumentBuilder();
} catch (ParserConfigurationException exc) {
throw new IllegalArgumentException(exc);

3
weixin-java-common/src/test/java/me/chanjar/weixin/common/util/crypto/WxCryptUtilTest.java
View File

@ -40,6 +40,7 @@ public class WxCryptUtilTest {
DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
documentBuilderFactory.setExpandEntityReferences(false);
documentBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder();
Document document = documentBuilder.parse(new InputSource(new StringReader(encryptedXml)));
@ -83,6 +84,8 @@ public class WxCryptUtilTest {
String afterEncrpt = pc.encrypt(this.replyMsg);
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setExpandEntityReferences(false);
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
DocumentBuilder db = dbf.newDocumentBuilder();
StringReader sr = new StringReader(afterEncrpt);
InputSource is = new InputSource(sr);

1
weixin-java-pay/src/main/java/com/github/binarywang/wxpay/bean/result/BaseWxPayResult.java
View File

@ -189,6 +189,7 @@ public abstract class BaseWxPayResult implements Serializable {
try {
final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setExpandEntityReferences(false);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
this.xmlDoc = factory.newDocumentBuilder()
.parse(new ByteArrayInputStream(this.xmlString.getBytes(StandardCharsets.UTF_8)));
return xmlDoc;

4
weixin-java-pay/src/test/java/com/github/binarywang/wxpay/bean/result/BaseWxPayResultTest.java
View File

@ -75,7 +75,9 @@ public class BaseWxPayResultTest {
@Test(expectedExceptions = {RuntimeException.class})
public void testToMap_with_empty_xmlString() {
WxPayOrderQueryResult result = new WxPayOrderQueryResult();
result.setXmlString(" ");
result.setXmlString( "<?xml version=\"1.0\" ?><!DOCTYPE doc " +
"[<!ENTITY win SYSTEM \"file:///C:/Users/user/Documents/testdata2.txt\">]" +
"><doc>&win;</doc>");
Map<String, String> map = result.toMap();
System.out.println(map);
}