CVE-2010-3260 (published 2011-04-27T00:55Z)

oxf/xml/xerces/XercesSAXParserFactoryImpl.java in the xforms-server component in the XForms service in Orbeon Forms before 3.9 does not properly restrict DTDs in Ajax requests, which allows remote attackers to read arbitrary files or send HTTP requests to intranet servers via an entity declaration in conjunction with an entity reference, related to an "XML injection" issue.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/orbeon/orbeon-forms
commit_details: repo_url: https://github.com/orbeon/orbeon-forms
author: ebruchez
author_date: 2010-12-03 16:32:48-08:00
msg: Implemented "[ #315668 ] Disable loading of external entities in XML parsing by default".
repository: repo_url: https://github.com/orbeon/orbeon-forms
repo_name: orbeon/orbeon-forms
description: Orbeon Forms is an open source web forms solution. It includes an XForms engine, the Form Builder web-based form editor, and the Form Runner runtime.
repo_language: Scala
owner: orbeon
file_changes: filename: XercesSAXParserFactoryImpl.java
change_type: ModificationType.MODIFY
diff: @@ -4,13 +4,9 @@ import org.orbeon.oxf.common.OXFException;
 import org.xml.sax.SAXException;
 import org.xml.sax.SAXNotRecognizedException;
 
-import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
 import javax.xml.parsers.SAXParserFactory;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.Hashtable;
-import java.util.Map;
+import java.util.*;
 
 /**
  * Boasts a couple of improvements over the 'stock' xerces parser factory.
@@ -42,23 +38,17 @@ public class XercesSAXParserFactoryImpl extends SAXParserFactory {
     static {
         {
             final OrbeonParserConfiguration configuration = XercesSAXParser.makeConfig(false, true);
-            final Collection features = configuration.getRecognizedFeatures();
-            recognizedFeaturesNonValidatingXInclude = Collections.unmodifiableCollection(features);
+            final Collection recognizedFeatures = configuration.getRecognizedFeatures();
+            recognizedFeaturesNonValidatingXInclude = Collections.unmodifiableCollection(recognizedFeatures);
             defaultFeaturesNonValidatingXInclude = configuration.getFeatures();
-            // This was being done in XMLUtils.createSaxParserFactory before.  Maybe want to
-            // move it back if we decide to make this class more general purpose.
-            defaultFeaturesNonValidatingXInclude.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);
-            defaultFeaturesNonValidatingXInclude.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);
+            addDefaultFeatures(defaultFeaturesNonValidatingXInclude);
         }
         {
             final OrbeonParserConfiguration configuration = XercesSAXParser.makeConfig(false, false);
             final Collection features = configuration.getRecognizedFeatures();
             recognizedFeaturesNonValidatingNoXInclude = Collections.unmodifiableCollection(features);
             defaultFeaturesNonValidatingNoXInclude = configuration.getFeatures();
-            // This was being done in XMLUtils.createSaxParserFactory before.  Maybe want to
-            // move it back if we decide to make this class more general purpose.
-            defaultFeaturesNonValidatingNoXInclude.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);
-            defaultFeaturesNonValidatingNoXInclude.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);
+            addDefaultFeatures(defaultFeaturesNonValidatingNoXInclude);
         }
 
         {
@@ -66,23 +56,25 @@ public class XercesSAXParserFactoryImpl extends SAXParserFactory {
             final Collection features = configuration.getRecognizedFeatures();
             recognizedFeaturesValidatingXInclude = Collections.unmodifiableCollection(features);
             defaultFeaturesValidatingXInclude = configuration.getFeatures();
-            // This was being done in XMLUtils.createSaxParserFactory before.  Maybe want to
-            // move it back if we decide to make this class more general purpose.
-            defaultFeaturesValidatingXInclude.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);
-            defaultFeaturesValidatingXInclude.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);
+            addDefaultFeatures(defaultFeaturesValidatingXInclude);
         }
         {
             final OrbeonParserConfiguration configuration = XercesSAXParser.makeConfig(true, false);
             final Collection features = configuration.getRecognizedFeatures();
             recognizedFeaturesValidatingNoXInclude = Collections.unmodifiableCollection(features);
             defaultFeaturesValidatingNoXInclude = configuration.getFeatures();
-            // This was being done in XMLUtils.createSaxParserFactory before.  Maybe want to
-            // move it back if we decide to make this class more general purpose.
-            defaultFeaturesValidatingNoXInclude.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);
-            defaultFeaturesValidatingNoXInclude.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);
+            addDefaultFeatures(defaultFeaturesValidatingNoXInclude);
         }
     }
 
+    private static void addDefaultFeatures(Map features) {
+        features.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);
+        features.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);
+        // For security purposes, disable external entities
+        features.put("http://xml.org/sax/features/external-general-entities", Boolean.FALSE);
+        features.put("http://xml.org/sax/features/external-parameter-entities", Boolean.FALSE);
+    }
+
     private final Hashtable features;
     private final boolean validating;
     private final boolean handleXInclude;
@@ -112,14 +104,13 @@ public class XercesSAXParserFactoryImpl extends SAXParserFactory {
         features.put(key, val ? Boolean.TRUE : Boolean.FALSE);
     }
 
-    public SAXParser newSAXParser() throws ParserConfigurationException {
+    public SAXParser newSAXParser() {
         final SAXParser ret;
         try {
             ret = new XercesJAXPSAXParser(this, features, validating, handleXInclude);
         } catch (final SAXException se) {
             // Translate to ParserConfigurationException
             throw new OXFException(se); // so we see a decent stack trace!
-//            throw new ParserConfigurationException(se.getMessage());
         }
         return ret;
     }

programming_language: Java