CVE-2021-43090: Improper Restriction of XML External Entity Reference (CWE-611)
value: An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2022-03-25T16:15Z
Repository: https://github.com/membrane/soa-model
Language: Other
Files changed: core/src/main/groovy/com/predic8/schema/Include.groovy, core/src/main/groovy/com/predic8/soamodel/AbstractParser.groovy
Commit date: 2021-10-26 19:28:53 +0200
Commit message: Fixes #281.

Diff: diff --git a/core/src/main/groovy/com/predic8/schema/Include.groovy b/core/src/main/groovy/com/predic8/schema/Include.groovy
index e42f6c2..2609306 100755
--- a/core/src/main/groovy/com/predic8/schema/Include.groovy
+++ b/core/src/main/groovy/com/predic8/schema/Include.groovy
@@ -36,12 +36,15 @@ class Include extends SchemaComponent {
     parseIncludedSchema(ctx)
   }
 
   private parseIncludedSchema(ctx){
     def resource = schema.resourceResolver.resolve(this, schema.baseDir)
-  	
-    def incToken = XMLInputFactory.newInstance().createXMLStreamReader(resource)
+
+    def inputFactory = XMLInputFactory.newInstance()
+    inputFactory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, false)
+    inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false)
+    def incToken = inputFactory.createXMLStreamReader(resource)
     while(incToken.hasNext()) {
       if(incToken.startElement) {
         if(incToken.name.getLocalPart() =='schema'){
           break
         }
diff --git a/core/src/main/groovy/com/predic8/soamodel/AbstractParser.groovy b/core/src/main/groovy/com/predic8/soamodel/AbstractParser.groovy
index d37cf9f..222f4d0 100755
--- a/core/src/main/groovy/com/predic8/soamodel/AbstractParser.groovy
+++ b/core/src/main/groovy/com/predic8/soamodel/AbstractParser.groovy
@@ -46,8 +46,11 @@ abstract class AbstractParser{
 	private getResourceToken(ctx) {
 		getToken(resourceResolver.resolve(ctx.input, ctx.baseDir))
 	}
 
 	private getToken(res) {
-		XMLInputFactory.newInstance().createXMLStreamReader(res)
+		def inputFactory = XMLInputFactory.newInstance()
+		inputFactory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, false)
+		inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false)
+		inputFactory.createXMLStreamReader(res)
 	}
 }

Vulnerable code:   	
    def incToken = XMLInputFactory.newInstance().createXMLStreamReader(resource)
		XMLInputFactory.newInstance().createXMLStreamReader(res)
Fixed code: 
    def inputFactory = XMLInputFactory.newInstance()
    inputFactory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, false)
    inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false)
    def incToken = inputFactory.createXMLStreamReader(resource)
		def inputFactory = XMLInputFactory.newInstance()
		inputFactory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, false)
		inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false)
		inputFactory.createXMLStreamReader(res)