XXE prevention via WSDLReader

657 views Asked by At

I'm using WSDLReader.readWSDL() to create a Wsdl Definition. I want to know if there is a flag available in javax.wsdl.WSDLReader to check for XXE attack in the WSDL ?

1

There are 1 answers

1
Sravanthi On

In Java you need to explicitly turn it off. Please try the featured in below link to turn it off https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#XMLReader

Adding the code related to the flags to be turned off from the link provided above:

XMLReader spf = XMLReaderFactory.createXMLReader();
spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd",false);