@Test public void createDocumentBuilderFactory() throws IOException, ParserConfigurationException, SAXException { DocumentBuilderFactory dbf = XmlUtils.createDocumentBuilderFactory(); try { Document document = dbf.newDocumentBuilder().parse(getXXEFileInjectionDocument()); NodeList nodeList = document.getElementsByTagName("test"); assertNotEquals(testString, nodeList.item(0).getTextContent()); } catch (SAXParseException e) { } }
public static DocumentBuilderFactory createDocumentBuilderFactory() { DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); try { dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); } catch (ParserConfigurationException e) { log.warn("XMLConstants.FEATURE_SECURE_PROCESSING not supported"); } try { dbf.setFeature(FEATURE_DISALLOW_DOCTYPE, true); } catch (ParserConfigurationException e) { log.warn("disallow-doctype-decl not supported"); } try { dbf.setFeature(FEATURE_EXTERNAL_GENERAL_ENTITIES, false); } catch (ParserConfigurationException e) { log.warn("external-general-entities not supported"); } try { dbf.setFeature(FEATURE_EXTERNAL_PARAMETER_ENTITIES, false); } catch (ParserConfigurationException e) { log.warn("external-parameter-entities not supported"); } return dbf; }
XmlUtils { public static DocumentBuilderFactory createDocumentBuilderFactory() { DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); try { dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); } catch (ParserConfigurationException e) { log.warn("XMLConstants.FEATURE_SECURE_PROCESSING not supported"); } try { dbf.setFeature(FEATURE_DISALLOW_DOCTYPE, true); } catch (ParserConfigurationException e) { log.warn("disallow-doctype-decl not supported"); } try { dbf.setFeature(FEATURE_EXTERNAL_GENERAL_ENTITIES, false); } catch (ParserConfigurationException e) { log.warn("external-general-entities not supported"); } try { dbf.setFeature(FEATURE_EXTERNAL_PARAMETER_ENTITIES, false); } catch (ParserConfigurationException e) { log.warn("external-parameter-entities not supported"); } return dbf; } }
XmlUtils { public static DocumentBuilderFactory createDocumentBuilderFactory() { DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); try { dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); } catch (ParserConfigurationException e) { log.warn("XMLConstants.FEATURE_SECURE_PROCESSING not supported"); } try { dbf.setFeature(FEATURE_DISALLOW_DOCTYPE, true); } catch (ParserConfigurationException e) { log.warn("disallow-doctype-decl not supported"); } try { dbf.setFeature(FEATURE_EXTERNAL_GENERAL_ENTITIES, false); } catch (ParserConfigurationException e) { log.warn("external-general-entities not supported"); } try { dbf.setFeature(FEATURE_EXTERNAL_PARAMETER_ENTITIES, false); } catch (ParserConfigurationException e) { log.warn("external-parameter-entities not supported"); } return dbf; } private  XmlUtils(); }
XmlUtils { public static DocumentBuilderFactory createDocumentBuilderFactory() { DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); try { dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); } catch (ParserConfigurationException e) { log.warn("XMLConstants.FEATURE_SECURE_PROCESSING not supported"); } try { dbf.setFeature(FEATURE_DISALLOW_DOCTYPE, true); } catch (ParserConfigurationException e) { log.warn("disallow-doctype-decl not supported"); } try { dbf.setFeature(FEATURE_EXTERNAL_GENERAL_ENTITIES, false); } catch (ParserConfigurationException e) { log.warn("external-general-entities not supported"); } try { dbf.setFeature(FEATURE_EXTERNAL_PARAMETER_ENTITIES, false); } catch (ParserConfigurationException e) { log.warn("external-parameter-entities not supported"); } return dbf; } private  XmlUtils(); static Document parseDocument(String xml); static Document parseDocument(InputStream documentXml); static Document parseDocument(InputStream documentXml, boolean namespaceAware); static String toXml(Node node); static Optional<Element> getFirstElementByTagName(Document doc, String tagName); static Element getElementXPathNS(Element parent, String xpathExpr, NamespaceContext nsCtx); static NodeList getElementsXPathNS(Element parent, String xpathExpr, NamespaceContext nsCtx); static Element getElementById(Document doc, String id); static byte[] canonicalize(String algorithmUri, Node node); static String prettyPrintXml(String xml); static String prettyPrintXml(Document document); static String prettyPrintXml(Document document, String charset, int indent); static DocumentBuilderFactory createDocumentBuilderFactory(); static XMLReader createXmlReader(); }
XmlUtils { public static DocumentBuilderFactory createDocumentBuilderFactory() { DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); try { dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); } catch (ParserConfigurationException e) { log.warn("XMLConstants.FEATURE_SECURE_PROCESSING not supported"); } try { dbf.setFeature(FEATURE_DISALLOW_DOCTYPE, true); } catch (ParserConfigurationException e) { log.warn("disallow-doctype-decl not supported"); } try { dbf.setFeature(FEATURE_EXTERNAL_GENERAL_ENTITIES, false); } catch (ParserConfigurationException e) { log.warn("external-general-entities not supported"); } try { dbf.setFeature(FEATURE_EXTERNAL_PARAMETER_ENTITIES, false); } catch (ParserConfigurationException e) { log.warn("external-parameter-entities not supported"); } return dbf; } private  XmlUtils(); static Document parseDocument(String xml); static Document parseDocument(InputStream documentXml); static Document parseDocument(InputStream documentXml, boolean namespaceAware); static String toXml(Node node); static Optional<Element> getFirstElementByTagName(Document doc, String tagName); static Element getElementXPathNS(Element parent, String xpathExpr, NamespaceContext nsCtx); static NodeList getElementsXPathNS(Element parent, String xpathExpr, NamespaceContext nsCtx); static Element getElementById(Document doc, String id); static byte[] canonicalize(String algorithmUri, Node node); static String prettyPrintXml(String xml); static String prettyPrintXml(Document document); static String prettyPrintXml(Document document, String charset, int indent); static DocumentBuilderFactory createDocumentBuilderFactory(); static XMLReader createXmlReader(); static final String FEATURE_EXTERNAL_GENERAL_ENTITIES; static final String FEATURE_DISALLOW_DOCTYPE; static final String FEATURE_EXTERNAL_PARAMETER_ENTITIES; }