PKumar022351 (Community Member) asked a question.
Improper Restriction of XML External Entity Reference (CWE ID 611)
My Existing code:
public synchronized Element parse(String xmlString) throws SAXException, IOException
{
Document doc = null;
DocumentBuilder documentBuilder = XMLParserUtils.getXMLDocBuilder();
if(xmlString!= null){
doc = documentBuilder.parse(new InputSource(new StringReader(xmlString)));
}
return doc.getDocumentElement();
}
Getting Improper Restriction of XML External Entity Reference in highlighted line. Can you please help how can resolve this flaws.
.png){kind=logo}
Hi @PKumar022351 (Community Member) ,
For CWE 611 XML External Entity Reference we recommend you review the section of the OWASP XXE Prevention Cheat Sheet specific to the technology you are using, you can find this here for the DocumentBuilderFactory: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4j .
This can be automatically detected by Veracode Static Analysis, but only if it is at most 1 level of indirection away from where it is used, if it is injected with dependency injection or similarly has multiple layers of indirection we may not be able to automatically detect the remediation and you should then propose a mitigation ( https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ ) and have this reviewed and approved by your organizations security team.
Thank you,
Boy Baukema