@Test public final void shoulInjectExternalEntity() throws IOException, XMLStreamException { XMLEventReader eventReader = XMLInputFactory.newInstance().createXMLEventReader(PropertiesUtils.getResourceAsStream(XML_FILE_WITH_XXE)); while(eventReader.hasNext()) { final XMLEvent event = eventReader.nextEvent(); if(event.isCharacters()) { Assert.assertTrue(event.asCharacters().getData().contains("root:x:0:0")); break; } } }
public static XMLInputFactory newInstance() { XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance(); xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE); xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE); xmlInputFactory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, Boolean.FALSE); return xmlInputFactory; }
XMLInputFactoryUtils { public static XMLInputFactory newInstance() { XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance(); xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE); xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE); xmlInputFactory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, Boolean.FALSE); return xmlInputFactory; } }
XMLInputFactoryUtils { public static XMLInputFactory newInstance() { XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance(); xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE); xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE); xmlInputFactory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, Boolean.FALSE); return xmlInputFactory; }  }
XMLInputFactoryUtils { public static XMLInputFactory newInstance() { XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance(); xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE); xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE); xmlInputFactory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, Boolean.FALSE); return xmlInputFactory; }  static XMLInputFactory newInstance(); }
XMLInputFactoryUtils { public static XMLInputFactory newInstance() { XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance(); xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE); xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE); xmlInputFactory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, Boolean.FALSE); return xmlInputFactory; }  static XMLInputFactory newInstance();  }