ZhouXY108/hutool
1
0
Fork 0
mirror of https://gitee.com/chinabugotech/hutool.git synced 2025-04-19 03:01:48 +08:00
Code Issues Packages Projects Releases Wiki Activity

修复CVE-2023-3276漏洞，XmlUtil.readBySax问题

Browse Source
This commit is contained in:
Looly 2023-06-16 20:23:06 +08:00
parent 143cd59b08
commit 2a786afd3f
2 changed files with 22 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGELOG.md
View File

@ -19,7 +19,8 @@
* 【extra 】 修复Sftp中exists方法父目录不存在时报错（issue#I7CSQ9@Gitee）
* 【extra 】 修复xml转json再转bean失败问题（issue#3139@Github）
* 【poi 】 修复RowUtil传入参数错误问题（issue#3139@Github）
* 【poi 】 修复XmlUtil.xmlToBean空节点转换失败问题（issue#3136@Github）
* 【core 】 修复XmlUtil.xmlToBean空节点转换失败问题（issue#3136@Github）
* 【core 】 修复CVE-2023-3276漏洞，XmlUtil.readBySax问题（issue#I7DX8W@Gitee）
-------------------------------------------------------------------------------------------------------------
# 5.8.19(2023-05-27)

20
hutool-core/src/main/java/cn/hutool/core/util/XmlUtil.java
View File

@ -293,6 +293,16 @@ public class XmlUtil {
factory = SAXParserFactory.newInstance();
factory.setValidating(false);
factory.setNamespaceAware(namespaceAware);
// https://blog.spoock.com/2018/10/23/java-xxe/
try{
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
} catch (final Exception ignore){
// ignore
}
}
// 2.从解析工厂获取解析器
final SAXParser parse;
@ -306,6 +316,16 @@ public class XmlUtil {
// 3.得到解读器
reader = parse.getXMLReader();
// 防止XEE攻击，见：https://www.jianshu.com/p/1a857905b22c
// https://blog.spoock.com/2018/10/23/java-xxe/
reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
// 忽略外部DTD
reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd",false);
// 不包括外部一般实体。
reader.setFeature("http://xml.org/sax/features/external-general-entities",false);
// 不包含外部参数实体或外部DTD子集。
reader.setFeature("http://xml.org/sax/features/external-parameter-entities",false);
reader.setContentHandler(contentHandler);
reader.parse(source);
} catch (ParserConfigurationException | SAXException e) {