XmlDocumentBuilder.java

package utils;

import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

/**
 * Class is used to configure and create a Document Builder for processing XML <br>
 * <br>
 * This file is part of the Security Shepherd Project.
 *
 * <p>The Security Shepherd project is free software: you can redistribute it and/or modify it under
 * the terms of the GNU General Public License as published by the Free Software Foundation, either
 * version 3 of the License, or (at your option) any later version.<br>
 *
 * <p>The Security Shepherd project is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
 * PURPOSE. See the GNU General Public License for more details.<br>
 *
 * <p>You should have received a copy of the GNU General Public License along with the Security
 * Shepherd project. If not, see <http://www.gnu.org/licenses/>.
 *
 * @author ismisepaul
 */
public class XmlDocumentBuilder {

  private static final Logger log = LogManager.getLogger(XmlDocumentBuilder.class);

  public static DocumentBuilder xmlDocBuilder(
      Boolean disallow_doctype_decl,
      Boolean external_general_entities,
      Boolean external_parameter_entities,
      Boolean load_external_dtd,
      Boolean xIncludeAware,
      Boolean expandEntityReferences) {

    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
    String FEATURE = null;
    DocumentBuilder db = null;

    try {
      // This is the PRIMARY defense. If DTDs (doctypes) are disallowed, almost all
      // XML entity attacks are prevented
      // Xerces 2 only - http://xerces.apache.org/xerces2-j/features.html#disallow-doctype-decl
      // safe=true
      FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";
      dbf.setFeature(FEATURE, disallow_doctype_decl);

      // If you can't completely disable DTDs, then at least do the following:
      // Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-general-entities
      // Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-general-entities
      // JDK7+ - http://xml.org/sax/features/external-general-entities
      // safe=false
      FEATURE = "http://xml.org/sax/features/external-general-entities";
      dbf.setFeature(FEATURE, external_general_entities);

      // Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-parameter-entities
      // Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-parameter-entities
      // JDK7+ - http://xml.org/sax/features/external-parameter-entities
      // safe=false
      FEATURE = "http://xml.org/sax/features/external-parameter-entities";
      dbf.setFeature(FEATURE, external_parameter_entities);

      // Disable external DTDs as well
      // safe=false
      FEATURE = "http://apache.org/xml/features/nonvalidating/load-external-dtd";
      dbf.setFeature(FEATURE, load_external_dtd);

      // and these as well, per Timothy Morgan's 2014 paper: "XML Schema, DTD, and Entity Attacks"
      // safe=false (for both)
      dbf.setXIncludeAware(xIncludeAware);
      dbf.setExpandEntityReferences(expandEntityReferences);

      // And, per Timothy Morgan: "If for some reason support for inline DOCTYPEs are a requirement,
      // then
      // ensure the entity settings are disabled (as shown above) and beware that SSRF attacks
      // (http://cwe.mitre.org/data/definitions/918.html) and denial
      // of service attacks (such as billion laughs or decompression bombs via "jar:") are a risk."
      db = dbf.newDocumentBuilder();

    } catch (ParserConfigurationException e) {
      // This should catch a failed setFeature feature
      log.warn(
          "ParserConfigurationException was thrown. The feature '"
              + FEATURE
              + "' is probably not supported by your XML processor.");
    }

    return db;
  }
}