The XXE security issue is one of the OWASP Top 10 security issues. The solution to the XXE issue is to disable XXE and DTD (Document Type Definition) processing. Therefore, when we are doing source code review, we are looking for whether the configuration of DTD is missing in the source code, as shown in the following example:
Factory.setFeature(“http://apache.org/xml/features/disallow-doctype-decl”, true);
White-box review is still the most efficient approach to identifying XXE issues. The easiest thing to do is to discover whether one of the following XML libraries is being used to parse XML. We may use one of the tools such as CRASS or VCG mentioned in previous section to do such a search with the keywords listed here:
|
Programming language |
Source code patterns for potential XXE issues |
|
Java |
SAXParser | SAXParserFactory... |
