XXE和BILLION LAUGHS

Question

使用xmlpullfactory是否可以笑xxe和十亿笑？我试过下面的xml代码

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE author [
<!ELEMENT author (#PCDATA)>
<!ENTITY js "Jo Smith">
]>
<author>&js;</author>

使用下面使用的kxml2-2.3.0.jar

的java代码解析上面的xml文件

try
{
        XmlPullParserFactory factory =XmlPullParserFactory.newInstance();
        XmlPullParser parser = factory.newPullParser();
        File file=new File("index.xml");
        FileReader fileReader = new FileReader(file);
        BufferedReader bufferedReader = new BufferedReader(fileReader);
        StringBuffer stringBuffer = new StringBuffer();
        String line;
        while ((line = bufferedReader.readLine()) != null) {
            stringBuffer.append(line);
            stringBuffer.append("\n");
        }
        fileReader.close();
        parser.setFeature(XmlPullParser.FEATURE_PROCESS_NAMESPACES,true);
        parser.setInput( new StringReader(stringBuffer.toString()) );
        while (true) {
                 int event = parser.nextToken();
                 if (event == XmlPullParser.START_TAG) {
                     System.out.println("Start-tag: " + parser.getName()) ;
                 }
                 else if (event == XmlPullParser.END_TAG) {
                     System.out.println("End-tag: " + parser.getName());
                 }
                 else if (event == XmlPullParser.START_DOCUMENT) {
                     System.out.println("Start document: "  +
                     parser.getText());
                 }
                 else if (event == XmlPullParser.TEXT) {
                     System.out.println("Text: " + parser.getText());
                 }
                 else if (event == XmlPullParser.CDSECT) {
                     System.out.println("CDATA Section: " +     
                     parser.getText());
                 }
                 else if (event == XmlPullParser.COMMENT) {
                     System.out.println("Comment: " + parser.getText());
                 }
                 else if (event == XmlPullParser.DOCDECL) {
                     System.out.println("Document type declaration: " +    
                     parser.getText());
                 }
                 else if (event == XmlPullParser.ENTITY_REF) {
                     System.out.println("Entity Reference: " +   
                     parser.getName());
                     System.out.println("Entity Reference value: " +    
                     parser.getText());
                 }
                 else if (event == XmlPullParser.IGNORABLE_WHITESPACE) {
                     System.out.println("Ignorable white space: " + 
                     parser.getText());
                 }
                 else if (event == XmlPullParser.PROCESSING_INSTRUCTION)   
                 {
                     System.out.println("Processing Instruction: " +      
                     parser.getText());
                 }
                 else if (event == XmlPullParser.END_DOCUMENT) {
                     System.out.println("End Document: " +     
                     parser.getText());
                     break;
                 } // end else if
              }  // end while
    }
    catch(Exception e)
    {
        e.printStackTrace();
    }

GOT OUTPUT AS

可忽略的空白区域：

文件类型声明：

author [
<!ELEMENT author (#PCDATA)>
<!ENTITY js "Jo Smith">
]

可忽略的空白区域： 开始标记：作者

实体参考：js

实体参考值：null

结束标记：作者 可忽略的空白区域：

结束文件：null

但是我想将实体引用值作为josmith.what会出现问题吗？

Answer 1

在API文档中，您似乎需要设置FEATURE_PROCESS_DOCDECL功能。