@Test(expected = XMLStreamException.class) public void xxeWithProtection() throws Exception { InputStream content = new ByteArrayInputStream(XML_XXE.getBytes("UTF-8")); XMLStreamReader streamReader = XmlHelper.createStreamReader(content); while (streamReader.hasNext()) { streamReader.next(); } }
public static XMLStreamReader createStreamReader(final Object content) throws EntityProviderException { if (content == null) { throw new EntityProviderException(EntityProviderException.ILLEGAL_ARGUMENT .addContent("Got not allowed NULL parameter for creation of XMLStreamReader.")); } XMLStreamReader streamReader; try { XMLInputFactory factory = getXMLInputFactory(); factory.setProperty(XMLInputFactory.IS_VALIDATING, false); factory.setProperty(XMLInputFactory.IS_NAMESPACE_AWARE, true); factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); factory.setProperty(XMLInputFactory.SUPPORT_DTD, false); if (content instanceof InputStream) { streamReader = factory.createXMLStreamReader((InputStream) content, DEFAULT_CHARSET); String characterEncodingInContent = streamReader.getCharacterEncodingScheme(); if (characterEncodingInContent != null && !DEFAULT_CHARSET.equalsIgnoreCase(characterEncodingInContent)) { throw new EntityProviderException(EntityProviderException .UNSUPPORTED_CHARACTER_ENCODING.addContent(characterEncodingInContent)); } } else { throw new EntityProviderException(EntityProviderException.ILLEGAL_ARGUMENT .addContent("Found not supported content of class '" + content.getClass() + "' to de-serialize.")); } return streamReader; } catch (XMLStreamException e) { throw new EntityProviderException(EntityProviderException.EXCEPTION_OCCURRED.addContent(e.getClass() .getSimpleName()), e); } }
XmlHelper { public static XMLStreamReader createStreamReader(final Object content) throws EntityProviderException { if (content == null) { throw new EntityProviderException(EntityProviderException.ILLEGAL_ARGUMENT .addContent("Got not allowed NULL parameter for creation of XMLStreamReader.")); } XMLStreamReader streamReader; try { XMLInputFactory factory = getXMLInputFactory(); factory.setProperty(XMLInputFactory.IS_VALIDATING, false); factory.setProperty(XMLInputFactory.IS_NAMESPACE_AWARE, true); factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); factory.setProperty(XMLInputFactory.SUPPORT_DTD, false); if (content instanceof InputStream) { streamReader = factory.createXMLStreamReader((InputStream) content, DEFAULT_CHARSET); String characterEncodingInContent = streamReader.getCharacterEncodingScheme(); if (characterEncodingInContent != null && !DEFAULT_CHARSET.equalsIgnoreCase(characterEncodingInContent)) { throw new EntityProviderException(EntityProviderException .UNSUPPORTED_CHARACTER_ENCODING.addContent(characterEncodingInContent)); } } else { throw new EntityProviderException(EntityProviderException.ILLEGAL_ARGUMENT .addContent("Found not supported content of class '" + content.getClass() + "' to de-serialize.")); } return streamReader; } catch (XMLStreamException e) { throw new EntityProviderException(EntityProviderException.EXCEPTION_OCCURRED.addContent(e.getClass() .getSimpleName()), e); } } }
XmlHelper { public static XMLStreamReader createStreamReader(final Object content) throws EntityProviderException { if (content == null) { throw new EntityProviderException(EntityProviderException.ILLEGAL_ARGUMENT .addContent("Got not allowed NULL parameter for creation of XMLStreamReader.")); } XMLStreamReader streamReader; try { XMLInputFactory factory = getXMLInputFactory(); factory.setProperty(XMLInputFactory.IS_VALIDATING, false); factory.setProperty(XMLInputFactory.IS_NAMESPACE_AWARE, true); factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); factory.setProperty(XMLInputFactory.SUPPORT_DTD, false); if (content instanceof InputStream) { streamReader = factory.createXMLStreamReader((InputStream) content, DEFAULT_CHARSET); String characterEncodingInContent = streamReader.getCharacterEncodingScheme(); if (characterEncodingInContent != null && !DEFAULT_CHARSET.equalsIgnoreCase(characterEncodingInContent)) { throw new EntityProviderException(EntityProviderException .UNSUPPORTED_CHARACTER_ENCODING.addContent(characterEncodingInContent)); } } else { throw new EntityProviderException(EntityProviderException.ILLEGAL_ARGUMENT .addContent("Found not supported content of class '" + content.getClass() + "' to de-serialize.")); } return streamReader; } catch (XMLStreamException e) { throw new EntityProviderException(EntityProviderException.EXCEPTION_OCCURRED.addContent(e.getClass() .getSimpleName()), e); } }  }
XmlHelper { public static XMLStreamReader createStreamReader(final Object content) throws EntityProviderException { if (content == null) { throw new EntityProviderException(EntityProviderException.ILLEGAL_ARGUMENT .addContent("Got not allowed NULL parameter for creation of XMLStreamReader.")); } XMLStreamReader streamReader; try { XMLInputFactory factory = getXMLInputFactory(); factory.setProperty(XMLInputFactory.IS_VALIDATING, false); factory.setProperty(XMLInputFactory.IS_NAMESPACE_AWARE, true); factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); factory.setProperty(XMLInputFactory.SUPPORT_DTD, false); if (content instanceof InputStream) { streamReader = factory.createXMLStreamReader((InputStream) content, DEFAULT_CHARSET); String characterEncodingInContent = streamReader.getCharacterEncodingScheme(); if (characterEncodingInContent != null && !DEFAULT_CHARSET.equalsIgnoreCase(characterEncodingInContent)) { throw new EntityProviderException(EntityProviderException .UNSUPPORTED_CHARACTER_ENCODING.addContent(characterEncodingInContent)); } } else { throw new EntityProviderException(EntityProviderException.ILLEGAL_ARGUMENT .addContent("Found not supported content of class '" + content.getClass() + "' to de-serialize.")); } return streamReader; } catch (XMLStreamException e) { throw new EntityProviderException(EntityProviderException.EXCEPTION_OCCURRED.addContent(e.getClass() .getSimpleName()), e); } }  static XMLInputFactory getXMLInputFactory(); static XMLOutputFactory getXMLOutputFactory(); static TransformerFactory getTransformerFactory(); static XMLStreamReader createStreamReader(final Object content); }
XmlHelper { public static XMLStreamReader createStreamReader(final Object content) throws EntityProviderException { if (content == null) { throw new EntityProviderException(EntityProviderException.ILLEGAL_ARGUMENT .addContent("Got not allowed NULL parameter for creation of XMLStreamReader.")); } XMLStreamReader streamReader; try { XMLInputFactory factory = getXMLInputFactory(); factory.setProperty(XMLInputFactory.IS_VALIDATING, false); factory.setProperty(XMLInputFactory.IS_NAMESPACE_AWARE, true); factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); factory.setProperty(XMLInputFactory.SUPPORT_DTD, false); if (content instanceof InputStream) { streamReader = factory.createXMLStreamReader((InputStream) content, DEFAULT_CHARSET); String characterEncodingInContent = streamReader.getCharacterEncodingScheme(); if (characterEncodingInContent != null && !DEFAULT_CHARSET.equalsIgnoreCase(characterEncodingInContent)) { throw new EntityProviderException(EntityProviderException .UNSUPPORTED_CHARACTER_ENCODING.addContent(characterEncodingInContent)); } } else { throw new EntityProviderException(EntityProviderException.ILLEGAL_ARGUMENT .addContent("Found not supported content of class '" + content.getClass() + "' to de-serialize.")); } return streamReader; } catch (XMLStreamException e) { throw new EntityProviderException(EntityProviderException.EXCEPTION_OCCURRED.addContent(e.getClass() .getSimpleName()), e); } }  static XMLInputFactory getXMLInputFactory(); static XMLOutputFactory getXMLOutputFactory(); static TransformerFactory getTransformerFactory(); static XMLStreamReader createStreamReader(final Object content);  }