CVE-2010-3260 (Java, published 2011-04-27T00:55Z)
Description: value: oxf/xml/xerces/XercesSAXParserFactoryImpl.java in the xforms-server component in the XForms service in Orbeon Forms before 3.9 does not properly restrict DTDs in Ajax requests, which allows remote attackers to read arbitrary files or send HTTP requests to intranet servers via an entity declaration in conjunction with an entity reference, related to an "XML injection" issue.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/orbeon/orbeon-forms
Files changed:
src/java/org/orbeon/oxf/xml/xerces/XercesSAXParserFactoryImpl.java
Commit message: Implemented "[ #315668 ] Disable loading of external entities in XML parsing by default".


Vulnerable code:
import javax.xml.parsers.ParserConfigurationException;
import java.util.Collection;
import java.util.Collections;
import java.util.Hashtable;
import java.util.Map;
            final Collection features = configuration.getRecognizedFeatures();
            recognizedFeaturesNonValidatingXInclude = Collections.unmodifiableCollection(features);
            // This was being done in XMLUtils.createSaxParserFactory before.  Maybe want to
            // move it back if we decide to make this class more general purpose.
            defaultFeaturesNonValidatingXInclude.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);
            defaultFeaturesNonValidatingXInclude.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);
            // This was being done in XMLUtils.createSaxParserFactory before.  Maybe want to
            // move it back if we decide to make this class more general purpose.
            defaultFeaturesNonValidatingNoXInclude.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);
            defaultFeaturesNonValidatingNoXInclude.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);
            // This was being done in XMLUtils.createSaxParserFactory before.  Maybe want to
            // move it back if we decide to make this class more general purpose.
            defaultFeaturesValidatingXInclude.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);
            defaultFeaturesValidatingXInclude.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);
            // This was being done in XMLUtils.createSaxParserFactory before.  Maybe want to
            // move it back if we decide to make this class more general purpose.
            defaultFeaturesValidatingNoXInclude.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);
            defaultFeaturesValidatingNoXInclude.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);
    public SAXParser newSAXParser() throws ParserConfigurationException {
//            throw new ParserConfigurationException(se.getMessage());

Fixed code:
import java.util.*;
            final Collection recognizedFeatures = configuration.getRecognizedFeatures();
            recognizedFeaturesNonValidatingXInclude = Collections.unmodifiableCollection(recognizedFeatures);
            addDefaultFeatures(defaultFeaturesNonValidatingXInclude);
            addDefaultFeatures(defaultFeaturesNonValidatingNoXInclude);
            addDefaultFeatures(defaultFeaturesValidatingXInclude);
            addDefaultFeatures(defaultFeaturesValidatingNoXInclude);
    private static void addDefaultFeatures(Map features) {
        features.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);
        features.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);
        // For security purposes, disable external entities
        features.put("http://xml.org/sax/features/external-general-entities", Boolean.FALSE);
        features.put("http://xml.org/sax/features/external-parameter-entities", Boolean.FALSE);
    }

    public SAXParser newSAXParser() {