DOM解析之DOM防护-XXE(外部实体注入漏洞)

最新的项目被微信告知一个漏洞需要解决，说是“XML外部实体注入漏洞”

也就是说涉及微信回调解析xml的过程需要补充一个防止外部实体注入的代码，以下以DOM为例。

具体代码如下：

这个是一个公共的方法用来解析之前加入xml防护

package com.net.pay.wxpay.util;

import java.io.IOException;

import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;

import org.apache.log4j.Logger;
import org.w3c.dom.Document;
import org.xml.sax.SAXException;

/**
 * 补充xml的防护
 * create by zhangqi 2018-11-19
 */
public class WXPayXmlUtil {
	
	private static Logger log = Logger.getLogger(WXPayXmlUtil.class);
	

	public static DocumentBuilder newDocumentBuilder() throws ParserConfigurationException {
		
		DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
		String FEATURE = null;
		try {
			// This is the PRIMARY defense. If DTDs (doctypes) are disallowed, almost all XML entity attacks are prevented
			// Xerces 2 only - http://xerces.apache.org/xerces2-j/features.html#disallow-doctype-decl
			FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";
			dbf.setFeature(FEATURE, true);
			
			// If you can't completely disable DTDs, then at least do the following:
			// Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-general-entities
			// Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-general-entities
			// JDK7+ - http://xml.org/sax/features/external-general-entities 
			FEATURE = "http://xml.org/sax/features/external-general-entities";
			dbf.setFeature(FEATURE, false);
			
			// Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-parameter-entities
			// Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-parameter-entities
			// JDK7+ - http://xml.org/sax/features/external-parameter-entities 
			FEATURE = "http://xml.org/sax/features/external-parameter-entities";
			dbf.setFeature(FEATURE, false);
			
			// Disable external DTDs as well
			FEATURE = "http://apache.org/xml/features/nonvalidating/load-external-dtd";
			dbf.setFeature(FEATURE, false);
			
			// and these as well, per Timothy Morgan's 2014 paper: "XML Schema, DTD, and Entity Attacks"
			dbf.setXIncludeAware(false);
			dbf.setExpandEntityReferences(false);
			
			// And, per Timothy Morgan: "If for some reason support for inline DOCTYPEs are a requirement, then 
			// ensure the entity settings are disabled (as shown above) and beware that SSRF attacks
			// (http://cwe.mitre.org/data/definitions/918.html) and denial 
			// of service attacks (such as billion laughs or decompression bombs via "jar:") are a risk."
			
			// remaining parser logic
		} catch (ParserConfigurationException e) {
			// This should catch a failed setFeature feature
			log.info("ParserConfigurationException was thrown. The feature '" +
			FEATURE + "' is probably not supported by your XML processor.");
		}
//		catch (SAXException e) {
//			// On Apache, this should be thrown when disallowing DOCTYPE
//			log.wait(, nanos)("A DOCTYPE was passed into the XML document");
//		}
//		catch (IOException e) {
//			// XXE that points to a file that doesn't exist
//			logger.error("IOException occurred, XXE may still possible: " + e.getMessage());
//		}
		
        return dbf.newDocumentBuilder();
    }
	
	
	public static Document newDocument() throws ParserConfigurationException {
        return newDocumentBuilder().newDocument();
    }
}

以下是将xml转换Map的代码：

package com.net.pay.wxpay.util;

import java.io.InputStream;
import java.io.ByteArrayInputStream;
import java.util.HashMap;
import java.util.Map;

import javax.xml.parsers.DocumentBuilder;

import org.apache.log4j.Logger;
import org.w3c.dom.Node;
import org.w3c.dom.NodeList;

import com.net.pay.wxpay.model.WXPayResult;

/**
 * XML外部实体注入防护
 * create by zhangqi 2018-11-19
 */
public class WxPaserXmlUtils {
	
	private static Logger log = Logger.getLogger(WxPaserXmlUtils.class);
	
	public static void main(String[] args) {
		Map<String, String> map = new HashMap<String, String>();
		map.put("return_code","success");
		System.out.println(map.get("trade_type")==null?null: map.get("trade_type").toString());
	}
	
	/**
     * XML格式字符串转换为Map
     *
     * @param strXML XML字符串
     * @return XML数据转换后的Map
     * @throws Exception
     */
    public static Map<String, String> xmlToMap(String strXML) throws Exception {
    	Map<String, String> data = new HashMap<String, String>();
        try {
            DocumentBuilder documentBuilder = WXPayXmlUtil.newDocumentBuilder();
            InputStream stream = new ByteArrayInputStream(strXML.getBytes("UTF-8"));
            org.w3c.dom.Document doc = documentBuilder.parse(stream);
            doc.getDocumentElement().normalize();
            NodeList nodeList = doc.getDocumentElement().getChildNodes();
            for (int idx = 0; idx < nodeList.getLength(); ++idx) {
                Node node = nodeList.item(idx);
                if (node.getNodeType() == Node.ELEMENT_NODE) {
                    org.w3c.dom.Element element = (org.w3c.dom.Element) node;
                    data.put(element.getNodeName(), element.getTextContent());
                }
            }
            try {
                stream.close();
            } catch (Exception ex) {
            	 ex.printStackTrace();
            }
        } catch (Exception ex) {
            ex.printStackTrace();
        }
        return data;
    }
	
}

参考技术文档：

DocumentBuilderFactory Api

Parser Features

XML External Entity (XXE) Prevention Cheat Sheet

DOM解析之DOM防护-XXE(外部实体注入漏洞)

猜你喜欢