mirror
/
FairEmail
mirror of https://github.com/M66B/FairEmail.git
1
0
Fork 0
Code Issues Releases Wiki Activity

XML security

This commit is contained in:
M66B 2023-12-06 13:41:16 +01:00
parent a6208bf8e8
commit 8346ded5c9
5 changed files with 18 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/src/main/java/biweekly/io/xml/XCalDocument.java
View File

@ -471,7 +471,9 @@ public class XCalDocument {
public void write(Writer writer, Map<String, String> outputProperties) throws TransformerException {
Transformer transformer;
try {
transformer = TransformerFactory.newInstance().newTransformer();
TransformerFactory factory = TransformerFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
transformer = factory.newTransformer();
} catch (TransformerConfigurationException e) {
//should never be thrown because we're not doing anything fancy with the configuration
throw new RuntimeException(e);

1
app/src/main/java/biweekly/io/xml/XCalReader.java
View File

@ -206,6 +206,7 @@ public class XCalReader extends StreamReader {
//create the transformer
try {
TransformerFactory factory = TransformerFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
XmlUtils.applyXXEProtection(factory);
transformer = factory.newTransformer();

11
app/src/main/java/biweekly/util/XmlUtils.java
View File

@ -154,6 +154,11 @@ public final class XmlUtils {
factory.setNamespaceAware(true);
factory.setIgnoringComments(true);
applyXXEProtection(factory);
try {
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
} catch (ParserConfigurationException ex) {
throw new SAXException(ex);
}
DocumentBuilder builder;
try {
@ -169,6 +174,7 @@ public final class XmlUtils {
/**
* Configures a {@link DocumentBuilderFactory} to protect it against XML
* External Entity attacks.
*
* @param factory the factory
* @see <a href=
* "https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Prevention_Cheat_Sheet#Java">
@ -198,6 +204,7 @@ public final class XmlUtils {
/**
* Configures a {@link TransformerFactory} to protect it against XML
* External Entity attacks.
*
* @param factory the factory
* @see <a href=
* "https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Prevention_Cheat_Sheet#Java">
@ -283,7 +290,9 @@ public final class XmlUtils {
*/
public static void toWriter(Node node, Writer writer, Map<String, String> outputProperties) throws TransformerException {
try {
Transformer transformer = TransformerFactory.newInstance().newTransformer();
TransformerFactory factory = TransformerFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
Transformer transformer = factory.newTransformer();
for (Map.Entry<String, String> property : outputProperties.entrySet()) {
try {
transformer.setOutputProperty(property.getKey(), property.getValue());

1
app/src/main/java/com/bugsnag/android/repackaged/dslplatform/json/XmlConverter.java
View File

@ -39,6 +39,7 @@ public abstract class XmlConverter {
static {
DocumentBuilderFactory dbFactory = DocumentBuilderFactory.newInstance();
try {
dbFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
documentBuilder = dbFactory.newDocumentBuilder();
} catch (ParserConfigurationException e) {
throw new RuntimeException(e);

5
app/src/main/java/com/sun/mail/handlers/text_xml.java
View File

@ -79,8 +79,9 @@ public class text_xml extends text_plain {
}
try {
Transformer transformer =
TransformerFactory.newInstance().newTransformer();
TransformerFactory factory = TransformerFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
Transformer transformer = factory.newTransformer();
StreamResult result = new StreamResult(os);
if (obj instanceof DataSource) {
// Streaming transform applies only to