@Test @Ignore public void parseEntityExpansionAttack() throws Exception { StringBuilder string0 = new StringBuilder(200) .append("<?xml version='1.0' encoding='iso-8859-1'?>\n") .append("<!DOCTYPE malicious [\n") .append(" <!ENTITY x0 \"\">\n") .append(" <!ENTITY x1 \"&x0;&x0;\">\n") .append(" <!ENTITY x2 \"&x1;&x1;\">\n") .append(" <!ENTITY x3 \"&x2;&x2;\">\n") .append(" <!ENTITY x4 \"&x3;&x3;\">\n") .append(" <!ENTITY x5 \"&x4;&x4;\">\n") .append(" <!ENTITY x6 \"&x5;&x5;\">\n") .append(" <!ENTITY x7 \"&x6;&x6;\">\n") .append(" <!ENTITY x8 \"&x7;&x7;\">\n") .append(" <!ENTITY x9 \"&x8;&x8;\">\n") .append(" <!ENTITY x10 \"&x9;&x9;\">\n") .append(" <!ENTITY x11 \"&x10;&x10;\">\n") .append(" <!ENTITY x12 \"&x11;&x11;\">\n") .append(" <!ENTITY x13 \"&x12;&x12;\">\n") .append(" <!ENTITY x14 \"&x13;&x13;\">\n") .append(" <!ENTITY x15 \"&x14;&x14;\">\n") .append(" <!ENTITY x16 \"&x15;&x15;\">\n") .append(" <!ENTITY x17 \"&x16;&x16;\">\n") .append(" <!ENTITY x18 \"&x17;&x17;\">\n") .append(" <!ENTITY x19 \"&x18;&x18;\">\n") .append(" <!ENTITY x20 \"&x19;&x19;\">\n") .append("]>\n") .append("<operation type=\"deliver\">\n") .append("<account username=\"test\" password=\"test\"/>\n") .append("<deliverRequest>\n") .append("<ticketId>&x20;test</ticketId>\n") .append(" <sourceAddress type=\"international\">+12065551212</sourceAddress>\n") .append(" <destinationAddress type=\"network\">40404</destinationAddress>\n") .append(" <text encoding=\"ISO-8859-1\">48656c6c6f20576f726c64</text>\n") .append("</deliverRequest> \n") .append("</operation >\n") .append(""); ByteArrayInputStream is = new ByteArrayInputStream(string0.toString().getBytes()); SxmpParser parser = new SxmpParser(); try { Operation operation = parser.parse(is); Assert.fail("should have thrown an exception"); } catch (SAXParseException e) { } }
public Operation parse(InputStream in) throws SxmpParsingException, IOException, SAXException, ParserConfigurationException { SAXParserFactory factory = SAXParserFactory.newInstance(); SAXParser parser = factory.newSAXParser(); parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: Handler handler = new Handler(); XMLReader reader = parser.getXMLReader(); reader.setContentHandler(handler); reader.setErrorHandler(handler); reader.setEntityResolver(handler); try { parser.parse(new InputSource(in), handler); } catch (com.sun.org.apache.xerces.internal.impl.io.MalformedByteSequenceException e) { throw new SxmpParsingException(SxmpErrorCode.INVALID_XML, "XML encoding mismatch", null); } if (handler.error != null) { throw handler.error; } if (handler.getOperation() == null) { throw new SxmpParsingException(SxmpErrorCode.MISSING_REQUIRED_ELEMENT, "The operation type [" + handler.operationType.getValue() + "] requires a request element", new PartialOperation(handler.operationType)); } try { handler.getOperation().validate(); } catch (SxmpErrorException e) { throw new SxmpParsingException(e.getErrorCode(), e.getErrorMessage(), handler.getOperation()); } return handler.getOperation(); }
SxmpParser { public Operation parse(InputStream in) throws SxmpParsingException, IOException, SAXException, ParserConfigurationException { SAXParserFactory factory = SAXParserFactory.newInstance(); SAXParser parser = factory.newSAXParser(); parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: Handler handler = new Handler(); XMLReader reader = parser.getXMLReader(); reader.setContentHandler(handler); reader.setErrorHandler(handler); reader.setEntityResolver(handler); try { parser.parse(new InputSource(in), handler); } catch (com.sun.org.apache.xerces.internal.impl.io.MalformedByteSequenceException e) { throw new SxmpParsingException(SxmpErrorCode.INVALID_XML, "XML encoding mismatch", null); } if (handler.error != null) { throw handler.error; } if (handler.getOperation() == null) { throw new SxmpParsingException(SxmpErrorCode.MISSING_REQUIRED_ELEMENT, "The operation type [" + handler.operationType.getValue() + "] requires a request element", new PartialOperation(handler.operationType)); } try { handler.getOperation().validate(); } catch (SxmpErrorException e) { throw new SxmpParsingException(e.getErrorCode(), e.getErrorMessage(), handler.getOperation()); } return handler.getOperation(); } }
SxmpParser { public Operation parse(InputStream in) throws SxmpParsingException, IOException, SAXException, ParserConfigurationException { SAXParserFactory factory = SAXParserFactory.newInstance(); SAXParser parser = factory.newSAXParser(); parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: Handler handler = new Handler(); XMLReader reader = parser.getXMLReader(); reader.setContentHandler(handler); reader.setErrorHandler(handler); reader.setEntityResolver(handler); try { parser.parse(new InputSource(in), handler); } catch (com.sun.org.apache.xerces.internal.impl.io.MalformedByteSequenceException e) { throw new SxmpParsingException(SxmpErrorCode.INVALID_XML, "XML encoding mismatch", null); } if (handler.error != null) { throw handler.error; } if (handler.getOperation() == null) { throw new SxmpParsingException(SxmpErrorCode.MISSING_REQUIRED_ELEMENT, "The operation type [" + handler.operationType.getValue() + "] requires a request element", new PartialOperation(handler.operationType)); } try { handler.getOperation().validate(); } catch (SxmpErrorException e) { throw new SxmpParsingException(e.getErrorCode(), e.getErrorMessage(), handler.getOperation()); } return handler.getOperation(); } SxmpParser();  SxmpParser(final String version); }
SxmpParser { public Operation parse(InputStream in) throws SxmpParsingException, IOException, SAXException, ParserConfigurationException { SAXParserFactory factory = SAXParserFactory.newInstance(); SAXParser parser = factory.newSAXParser(); parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: Handler handler = new Handler(); XMLReader reader = parser.getXMLReader(); reader.setContentHandler(handler); reader.setErrorHandler(handler); reader.setEntityResolver(handler); try { parser.parse(new InputSource(in), handler); } catch (com.sun.org.apache.xerces.internal.impl.io.MalformedByteSequenceException e) { throw new SxmpParsingException(SxmpErrorCode.INVALID_XML, "XML encoding mismatch", null); } if (handler.error != null) { throw handler.error; } if (handler.getOperation() == null) { throw new SxmpParsingException(SxmpErrorCode.MISSING_REQUIRED_ELEMENT, "The operation type [" + handler.operationType.getValue() + "] requires a request element", new PartialOperation(handler.operationType)); } try { handler.getOperation().validate(); } catch (SxmpErrorException e) { throw new SxmpParsingException(e.getErrorCode(), e.getErrorMessage(), handler.getOperation()); } return handler.getOperation(); } SxmpParser();  SxmpParser(final String version); Operation parse(InputStream in); }
SxmpParser { public Operation parse(InputStream in) throws SxmpParsingException, IOException, SAXException, ParserConfigurationException { SAXParserFactory factory = SAXParserFactory.newInstance(); SAXParser parser = factory.newSAXParser(); parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: parser.getXMLReader().setFeature("http: Handler handler = new Handler(); XMLReader reader = parser.getXMLReader(); reader.setContentHandler(handler); reader.setErrorHandler(handler); reader.setEntityResolver(handler); try { parser.parse(new InputSource(in), handler); } catch (com.sun.org.apache.xerces.internal.impl.io.MalformedByteSequenceException e) { throw new SxmpParsingException(SxmpErrorCode.INVALID_XML, "XML encoding mismatch", null); } if (handler.error != null) { throw handler.error; } if (handler.getOperation() == null) { throw new SxmpParsingException(SxmpErrorCode.MISSING_REQUIRED_ELEMENT, "The operation type [" + handler.operationType.getValue() + "] requires a request element", new PartialOperation(handler.operationType)); } try { handler.getOperation().validate(); } catch (SxmpErrorException e) { throw new SxmpParsingException(e.getErrorCode(), e.getErrorMessage(), handler.getOperation()); } return handler.getOperation(); } SxmpParser();  SxmpParser(final String version); Operation parse(InputStream in); static final String VERSION_1_0; static final String VERSION_1_1; static final String VERSION_1_2; }