XML External Entity Injection: Hp Fortify issue in java 1.6

Question

I was trying to fix XEE issue and have tried other options but won't work. Would be great if there were any pointers.

Below is my code snippet..

ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
Source xmlSource = new DOMSource(feed);
Result outputTarget = new StreamResult(outputStream);
TransformerFactory.newInstance().newTransformer().transform(xmlSource,outputTarget);
is = new ByteArrayInputStream(outputStream.toByteArray());

Answer 1

Have a look at OWASP XXE Prevention Cheat Sheet

based of what i see in your code, you should modifiy it like this :

ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
Source xmlSource = new DOMSource(feed);
Result outputTarget = new StreamResult(outputStream);

TransformerFactory tf = TransformerFactory.newInstance();
tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");

tf.newTransformer().transform(xmlSource,outputTarget);
is = new ByteArrayInputStream(outputStream.toByteArray());