From a60a38c68fd0be42784767a589650c3a7de62bec Mon Sep 17 00:00:00 2001 From: Elmir Shamsutdinov Date: Thu, 6 Aug 2026 13:48:51 +0300 Subject: [PATCH 1/3] added xml xxe protection --- .../pgsqlblocks/xmlstore/XmlStore.java | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/src/main/java/ru/taximaxim/pgsqlblocks/xmlstore/XmlStore.java b/src/main/java/ru/taximaxim/pgsqlblocks/xmlstore/XmlStore.java index 5a24cf6..a274912 100644 --- a/src/main/java/ru/taximaxim/pgsqlblocks/xmlstore/XmlStore.java +++ b/src/main/java/ru/taximaxim/pgsqlblocks/xmlstore/XmlStore.java @@ -95,7 +95,14 @@ public void writeObjects(List list) { Path path = getXmlFile(); Files.createDirectories(path.getParent()); try (Writer xmlWriter = Files.newBufferedWriter(path, StandardCharsets.UTF_8)) { - Document xml = DocumentBuilderFactory.newInstance().newDocumentBuilder().newDocument(); + DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); + factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); + factory.setFeature("http://xml.org/sax/features/external-general-entities", false); + factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + factory.setXIncludeAware(false); + factory.setExpandEntityReferences(false); + + Document xml = factory.newDocumentBuilder().newDocument(); Element root = xml.createElement(rootTag); root.setAttribute(KEY_VERSION, VALUE_VERSION); xml.appendChild(root); @@ -116,8 +123,14 @@ public void writeObjects(List list) { */ private Document readXml(Reader reader) throws IOException, SAXException { try { - Document xml = DocumentBuilderFactory.newInstance().newDocumentBuilder() - .parse(new InputSource(reader)); + DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); + // Disable DOCTYPE declarations entirely + factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); + // Disable external general entities + factory.setFeature("http://xml.org/sax/features/external-general-entities", false); + // Disable external parameter entities + factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + Document xml = factory.newDocumentBuilder().parse(new InputSource(reader)); xml.normalize(); if (!xml.getDocumentElement().getNodeName().equals(rootTag)) { From a8ded156e1827c0719107eb29da1a525d1892fb0 Mon Sep 17 00:00:00 2001 From: Elmir Shamsutdinov Date: Thu, 6 Aug 2026 14:00:00 +0300 Subject: [PATCH 2/3] updated changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7c75fc0..db2aae3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,7 @@ java-приложение для работы с блокировками в С * Обновлена лицензия * Обновлены библиотеки +* Исправлена уязвимость при чтении XML 1.9.0 From 15d27d9cf3f8fb322576793ae9417c065dd55566 Mon Sep 17 00:00:00 2001 From: Elmir Shamsutdinov Date: Thu, 6 Aug 2026 14:58:56 +0300 Subject: [PATCH 3/3] updated by feedback --- .../pgsqlblocks/xmlstore/XmlStore.java | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/src/main/java/ru/taximaxim/pgsqlblocks/xmlstore/XmlStore.java b/src/main/java/ru/taximaxim/pgsqlblocks/xmlstore/XmlStore.java index a274912..c8165a3 100644 --- a/src/main/java/ru/taximaxim/pgsqlblocks/xmlstore/XmlStore.java +++ b/src/main/java/ru/taximaxim/pgsqlblocks/xmlstore/XmlStore.java @@ -25,6 +25,7 @@ import java.util.ArrayList; import java.util.List; +import javax.xml.XMLConstants; import javax.xml.parsers.DocumentBuilderFactory; import javax.xml.parsers.ParserConfigurationException; import javax.xml.transform.OutputKeys; @@ -95,14 +96,7 @@ public void writeObjects(List list) { Path path = getXmlFile(); Files.createDirectories(path.getParent()); try (Writer xmlWriter = Files.newBufferedWriter(path, StandardCharsets.UTF_8)) { - DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); - factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); - factory.setFeature("http://xml.org/sax/features/external-general-entities", false); - factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); - factory.setXIncludeAware(false); - factory.setExpandEntityReferences(false); - - Document xml = factory.newDocumentBuilder().newDocument(); + Document xml = DocumentBuilderFactory.newInstance().newDocumentBuilder().newDocument(); Element root = xml.createElement(rootTag); root.setAttribute(KEY_VERSION, VALUE_VERSION); xml.appendChild(root); @@ -130,6 +124,15 @@ private Document readXml(Reader reader) throws IOException, SAXException { factory.setFeature("http://xml.org/sax/features/external-general-entities", false); // Disable external parameter entities factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + // Disable loading external DTDs + factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); + // Disabling XInclude + factory.setXIncludeAware(false); + // Disable entity expansion (protection against Billion Laughs) + factory.setExpandEntityReferences(false); + // Prohibit the use of all protocols by external entities (JAXP 1.5+) + factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); + factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); Document xml = factory.newDocumentBuilder().parse(new InputSource(reader)); xml.normalize();