[#YANGTOOLS-1211] Can XML injection protection settings be added to XmlParserStream.java?

[YANGTOOLS-1211] Can XML injection protection settings be added to XmlParserStream.java? Created: 25/Jan/21 Updated: 25/Jan/21
Status:	Open
Project:	yangtools
Component/s:	None
Affects Version/s:	None
Fix Version/s:	None

Type:

Improvement

Priority:

Low

Reporter:

march much

Assignee:

Unassigned

Resolution:

Unresolved

Votes:

Labels:

None

Remaining Estimate:

Not Specified

Time Spent:

Not Specified

Original Estimate:

Not Specified

Description

Can XML injection protection settings be added to XmlParserStream.java? For example:
final TransformerFactory tf = TransformerFactory.newInstance();
tf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

Comments

Comment by Robert Varga [ 25/Jan/21 ]

I do not see how it could be attacked even today. The transformer does not process a raw document, but rather a stream of events coming from a (I am pretty sure) secured XMLStreamWriter. By the time the transformer sees it, the document's contents should've been defanged.

If not, please provide a test case.

Generated at Wed Feb 07 20:55:30 UTC 2024 using Jira 8.20.10#820010-sha1:ace47f9899e9ee25d7157d59aa17ab06aee30d3d.

[YANGTOOLS-1211] Can XML injection protection settings be added to XmlParserStream.java? Created: 25/Jan/21 Updated: 25/Jan/21