java-xxe-defense-demo
2018年8月，在微信支付SDK的XXE影响下，写了百分百可以防御住的demo，并且经过了配置，有些配置是冗余的。
2019年7月，重新测试了每个设置对XXE的影响，之前为了保险建议全部都添加，现在筛选出了起作用的和不起作用的设置。
测试方式是使用两种poc，看是否可以读取到文件，一种是使用通用实体(external-general-entity)，将文件内容打到xml的内容里，一种是使用参数实体(external-parameter-entity)，将文件内容外带。
配合攻击demo食用更佳：https://github.com/LeadroyaL/java_xxe_2019
有效的防御方式的列表
| FEATURE | String |
|---|---|
| A | http://javax.xml.XMLConstants/feature/secure-processing |
| B | http://apache.org/xml/features/disallow-doctype-decl |
| C | http://xml.org/sax/features/external-parameter-entities |
| D | http://xml.org/sax/features/external-general-entities |
| E | http://javax.xml.XMLConstants/property/accessExternalDTD |
| F | http://javax.xml.XMLConstants/property/accessExternalStylesheet |
| G | http://javax.xml.XMLConstants/property/accessExternalSchema |
| H | javax.xml.stream.supportDTD |
| I | javax.xml.stream.isSupportingExternalEntities |
| 组件 | FEATURE | 作用 |
|---|---|---|
| DocumentBuilderFactory | A | 禁用DTD |
| DocumentBuilderFactory | B | 禁用DTD |
| DocumentBuilderFactory | C | 可挡blind-xxe |
| DocumentBuilderFactory | D | 可挡回显xxe |
| SAXBuilder | A | 禁用DTD |
| SAXBuilder | C | 可挡blind-xxe |
| SAXParserFactory | B | 禁用DTD |
| SAXParserFactory | C | 可挡blind-xxe |
| SAXParserFactory | D | 不确定，因为默认无回显 |
| SAXReader | B | 禁用DTD |
| SAXReader | C | 可挡blind-xxe |
| SAXReader | D | 可挡回显xxe |
| SAXTransformerFactory | E | 禁用DTD |
| SAXTransformerFactory | F | 不确定，引入额外stylesheet没有攻击成功 |
| SchemaFactory | E | 禁用DTD |
| SchemaFactory | G | 不确定，引入额外schema没有攻击成功 |
| TransformerFactory | E | 禁用DTD |
| TransformerFactory | F | 不确定，引入额外stylesheet没有攻击成功 |
| Unmarshaller | - | 默认禁用DTD |
| Validator | E | 禁用DTD |
| Validator | G | 不确定，引入额外schema没有攻击成功 |
| XMLInputFactory | H | 禁用DTD |
| XMLInputFactory | I | 禁用DTD |
| XMLReaderFactory | B | 禁用DTD |
| XMLReaderFactory | C | 可挡blind-xxe |
| XMLReaderFactory | D | 不确定，因为默认无回显 |
输出全部支持的feature和properties:
com.sun.org.apache.xerces.internal.impl.Constants.Main(String[] args)
推荐的最小化配置（出锅了别怪我）
一般来说，禁用了DTD就万事大吉了，禁用了通用实体就不会被回显，禁用了参数实体就不会被oob。
DocumentBuilderFactory_v1
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
String FEATURE = null;
FEATURE = XMLConstants.FEATURE_SECURE_PROCESSING;
dbf.setFeature(FEATURE, true);
DocumentBuilder builder = dbf.newDocumentBuilder();DocumentBuilderFactory_v2
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
String FEATURE = null;
FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";
dbf.setFeature(FEATURE, true);
DocumentBuilder builder = dbf.newDocumentBuilder();DocumentBuilderFactory_v3
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
String FEATURE = null;
FEATURE = "http://xml.org/sax/features/external-parameter-entities";
dbf.setFeature(FEATURE, false);
FEATURE = "http://xml.org/sax/features/external-general-entities";
dbf.setFeature(FEATURE, false);
DocumentBuilder builder = dbf.newDocumentBuilder();SAXBuilder
SAXBuilder builder = new SAXBuilder();
builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
Document doc = builder.build(ResourceUtils.getPoc1());SAXParserFactory
SAXParserFactory spf = SAXParserFactory.newInstance();
spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
SAXParser parser = spf.newSAXParser();
parser.parse(ResourceUtils.getPoc1(), (HandlerBase) null);SAXReader_v1
SAXReader saxReader = new SAXReader();
saxReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
org.dom4j.Document doc = saxReader.read(ResourceUtils.getPoc1());SAXReader_v2
SAXReader saxReader = new SAXReader();
saxReader.setFeature("http://xml.org/sax/features/external-general-entities", false);
saxReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
org.dom4j.Document doc = saxReader.read(ResourceUtils.getPoc1());SAXTransformerFactory
SAXTransformerFactory sf = (SAXTransformerFactory) SAXTransformerFactory.newInstance();
sf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
StreamSource source = new StreamSource(ResourceUtils.getPoc3());
sf.newXMLFilter(source);SchemaFactory
SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
StreamSource source = new StreamSource(ResourceUtils.getPoc1());
Schema schema = factory.newSchema(source);TransformerFactory
TransformerFactory tf = TransformerFactory.newInstance();
tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
StreamSource source = new StreamSource(ResourceUtils.getPoc1());
tf.newTransformer().transform(source, new DOMResult());Unmarshaller
Class tClass = Person.class;
JAXBContext context = JAXBContext.newInstance(tClass);
Unmarshaller um = context.createUnmarshaller();
Object o = um.unmarshal(ResourceUtils.getPoc2());
tClass.cast(o);Validator
SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");
Schema schema = factory.newSchema();
Validator validator = schema.newValidator();
validator.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
StreamSource source = new StreamSource(ResourceUtils.getPoc1());
validator.validate(source);XMLInputFactory_v1
XMLInputFactory xmlInputFactory = XMLInputFactory.newFactory();
xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
XMLStreamReader reader = xmlInputFactory.createXMLStreamReader(ResourceUtils.getPoc1());XMLInputFactory_v2
XMLInputFactory xmlInputFactory = XMLInputFactory.newFactory();
xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
XMLStreamReader reader = xmlInputFactory.createXMLStreamReader(ResourceUtils.getPoc1());XMLReader
XMLReader reader = XMLReaderFactory.createXMLReader();
reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
reader.parse(new InputSource(ResourceUtils.getPoc1()));