CODEWITHSUNDEEP
javaandroidxmlsecuritysaxparser
dcanh121
dcanh121

Reputation: 4695

Solve security issue parsing xml using SAX parser

I have an android app, in which user can enter any xml source url to parse. My app then parses the xml(if valid) and displays results.

The issue is, if the user enters an untrusted xml source url, the app and/or the device might be effected.

What are the best ways to identify risk and prevent exploit.

With my research I found that enabling FEATURE_SECURE_PROCESSING and disabling expansion might help. But can anyone tell me what it is, and how do I achieve it.

Thanks.

Upvotes: 6

Views: 18375

Answers (2)

Pierre Ernst
Pierre Ernst

Reputation: 524

  • For SAX and DOM parsers, disallowing DTD should be sufficient as dcanh121 noted.

    factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

  • For StAX parser:

    factory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, false);

Upvotes: 2

dcanh121
dcanh121

Reputation: 4695

After researching, I found this. I hope this would solve my problem.

To enable FEATURE_SECURE_PROCESSING

SAXParserFactory spf = SAXParserFactory.newInstance();
spf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

Disable DTDs

spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

Upvotes: 6

Related Questions