XXE 漏洞代码及修复代码整理

<?xml version="1.0" encoding="ISO-8859-1" ?>        <!DOCTYPE example [                <!ELEMENT example ANY >                <!ENTITY file SYSTEM "http://localhost:10000" >                ]><example>&file;</example>

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();        String FEATURE = null;//        dbf.setExpandEntityReferences无法防止xxe        dbf.setExpandEntityReferences(false);        DocumentBuilder documentBuilder = dbf.newDocumentBuilder();        Document document = documentBuilder.parse(new File("poc.xml"));

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();        String FEATURE = null;        FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";        dbf.setFeature(FEATURE, true);        FEATURE = "http://xml.org/sax/features/external-general-entities";        dbf.setFeature(FEATURE, false);        FEATURE = "http://xml.org/sax/features/external-parameter-entities";        dbf.setFeature(FEATURE, false);        FEATURE = "http://apache.org/xml/features/nonvalidating/load-external-dtd";        dbf.setFeature(FEATURE, false);        dbf.setXIncludeAware(false);//        dbf.setExpandEntityReferences无法防止xxe        dbf.setExpandEntityReferences(false);        DocumentBuilder documentBuilder = dbf.newDocumentBuilder();

DOMParser domParser = new DOMParser();domParser.parse(new FileInputStream(new File("src/main/java/xxe/poc.xml")));

DOMParser domParser = new DOMParser();// Do not expand entity references     domParser.setAttribute(DOMParser.EXPAND_ENTITYREF, false);domParser.parse(new FileInputStream(new File("poc.xml")));

File file = new File("poc.xml");SAXBuilder sb = new SAXBuilder();Document doc = sb.build(file);

File file = new File("src/main/java/xxe/poc_bind.xml");SAXBuilder sb = new SAXBuilder();sb.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);sb.setFeature("http://xml.org/sax/features/external-general-entities", false);sb.setFeature("http://xml.org/sax/features/external-parameter-entities", false);sb.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);

SAXParserFactory spf = SAXParserFactory.newInstance();File file = new File("poc.xml");SAXParser parser = spf.newSAXParser();parser.parse(file, (HandlerBase) null);

SAXParserFactory spf = SAXParserFactory.newInstance();spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);spf.setFeature("http://xml.org/sax/features/external-general-entities", false);spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);File file = new File("poc.xml");SAXParser parser = spf.newSAXParser();parser.parse(file, (HandlerBase) null);

File file = new File("poc.xml");SAXReader saxReader = new SAXReader();saxReader.read(file);

File file = new File("poc.xml");SAXReader saxReader = new SAXReader();saxReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);saxReader.setFeature("http://xml.org/sax/features/external-general-entities", false);saxReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);saxReader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);saxReader.read(file);

File file = new File("poc.xml");StreamSource source = new StreamSource(file);SAXTransformerFactory sf = (SAXTransformerFactory) SAXTransformerFactory.newInstance();        sf.newTransformerHandler(source);

File file = new File("poc.xml");StreamSource source = new StreamSource(file);SAXTransformerFactory sf = (SAXTransformerFactory) SAXTransformerFactory.newInstance();sf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");sf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");sf.newTransformerHandler(source);

SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");File file = new File("poc.xml");factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");StreamSource source = new StreamSource(file);Schema schema = factory.newSchema(source);

SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");File file = new File("src/main/java/xxe/poc.xml");factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");StreamSource source = new StreamSource(file);Schema schema = factory.newSchema(source);

TransformerFactory tf = TransformerFactory.newInstance();File file = new File("poc.xml");StreamSource source = new StreamSource(file);tf.newTransformer().transform(source, new DOMResult());

TransformerFactory tf = TransformerFactory.newInstance();tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");File file = new File("poc.xml");StreamSource source = new StreamSource(file);tf.newTransformer().transform(source, new DOMResult());

SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");Schema schema = factory.newSchema();Validator validator = schema.newValidator();File file = new File("poc.xml");StreamSource source = new StreamSource(file);validator.validate(source);

SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");Schema schema = factory.newSchema();Validator validator = schema.newValidator();    validator.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");       validator.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");File file = new File("poc.xml");StreamSource source = new StreamSource(file);validator.validate(source);

XMLInputFactory xmlInputFactory = XMLInputFactory.newFactory();File file = new File("poc.xml");XMLStreamReader reader = xmlInputFactory.createXMLStreamReader(new FileInputStream(file));try {     while (reader.hasNext()) {            int type = reader.next();            if (type == XMLStreamConstants.START_ELEMENT) {//开始节点                System.out.print(reader.getName());                } else if (type == XMLStreamConstants.CHARACTERS) {//表示事件字符                    System.out.println("type" + type);                } else if (type == XMLStreamConstants.END_ELEMENT) {//结束节点                    System.out.println(reader.getName());                }            }            reader.close();        } catch (Exception e) {            e.printStackTrace();        }

XMLInputFactory xmlInputFactory = XMLInputFactory.newFactory();xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);File file = new File("poc.xml");...

XMLReader reader = XMLReaderFactory.createXMLReader();File file = new File("poc.xml");reader.parse(new InputSource(new FileInputStream(file)));

XMLReader reader = XMLReaderFactory.createXMLReader();File file = new File("poc.xml");reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);reader.setFeature("http://xml.org/sax/features/external-general-entities", false);reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);reader.parse(new InputSource(new FileInputStream(file)));

File file = new File("test.xlsx");
        XSSFWorkbook xssfSheets = new XSSFWorkbook(new FileInputStream(file));        XSSFSheet sheet = xssfSheets.getSheetAt(0);        int lastRowNum = sheet.getLastRowNum();        for (Row row:sheet){            for(Cell cell:row){                System.out.println(cell.getStringCellValue()+" ");            }        }

1. 使用Excel新建一个xlsx文件2. 修改后缀名为zip,并使用zip解压缩3. 在[Content_Types].xml文件上增加恶意数据