7z apache解析漏洞_XXE 漏洞代码及修复代码整理

XML原理

XXE：XML External Entity 即XML外部实体注入攻击。是由于程序在解析输入的XML数据时，解析了攻击者伪造的外部实体，通过外部实体SYSTEM请求本地文件uri，通过某种方式返回本地的文件内容，导致了XXE漏洞。

java中出现的场景

poc.xml

<?xml version="1.0" encoding="ISO-8859-1" ?>
        <!DOCTYPE example [
                <!ELEMENT example ANY >
                <!ENTITY file SYSTEM "http://localhost:10000" >
                ]>
<example>&file;</example>

DocumentBuilderFactory

漏洞代码

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
        String FEATURE = null;
//        dbf.setExpandEntityReferences无法防止xxe
        dbf.setExpandEntityReferences(false);
        DocumentBuilder documentBuilder = dbf.newDocumentBuilder();
        Document document = documentBuilder.parse(new File("poc.xml"));

修复代码

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
        String FEATURE = null;
        FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";
        dbf.setFeature(FEATURE, true);
        FEATURE = "http://xml.org/sax/features/external-general-entities";
        dbf.setFeature(FEATURE, false);
        FEATURE = "http://xml.org/sax/features/external-parameter-entities";
        dbf.setFeature(FEATURE, false);
        FEATURE = "http://apache.org/xml/features/nonvalidating/load-external-dtd";
        dbf.setFeature(FEATURE, false);
        dbf.setXIncludeAware(false);
//        dbf.setExpandEntityReferences无法防止xxe
        dbf.setExpandEntityReferences(false);
        DocumentBuilder documentBuilder = dbf.newDocumentBuilder();

DOMParser

漏洞代码

DOMParser domParser = new DOMParser();
domParser.parse(new FileInputStream(new File("src/main/java/xxe/poc.xml")));

修复代码

DOMParser domParser = new DOMParser();
// Do not expand entity references     dom