Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: added schema CS

...

Code Block
bgColor#FFcccc
private void createXMLStream(BufferedOutputStream outStream, String quantity)
             throws IOException {
  String xmlString;
  xmlString = "<item>\n<description>Widget</description>\n<price>500.0</price>\n" +
              "<quantity>" + quantity + "</quantity></item>";
  outStream.write(xmlString.getBytes());
  outStream.flush();
}

...

Code Block
bgColor#ccccff
private void createXMLStream(BufferedOutputStream outStream, String quantity)
             throws IOException {
  // Write XML string if quantity contains numbers only (whitelisting)
  // Blacklisting of invalid characters can also be done in conjunction

  if (!Pattern.matches("[0-9]+", quantity)) {
    // Format violation
  }

  String xmlString = "<item>\n<description>Widget</description>\n<price>500</price>\n" +
                     "<quantity>" + quantity + "</quantity></item>";
  outStream.write(xmlString.getBytes());
  outStream.flush();
}

Compliant Solution (XML Schema)

A more general mechanism for checking XML for attempted injection is to validate it using a DTD or schema. The schema must be rigidly defined to prevent injections from being mistaken for valid XML. Here is a suitable schema for validating our XML snippet:

Code Block
bgColor#ccccff

<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
<xs:element name="item">
  <xs:complexType>
    <xs:sequence>
      <xs:element name="description" type="xs:string"/>
      <xs:element name="price" type="xs:decimal"/>
      <xs:element name="quantity" type="xs:integer"/>      
    </xs:sequence>
  </xs:complexType>
</xs:element>
</xs:schema>

This compliant code example employs this schema to prevent XML injection from succeeding. The schema is avaialble as the file schema.xsd.

Code Block
bgColor#ccccff

private void createXMLStream(BufferedOutputStream outStream, String quantity)
             throws IOException {
  String xmlString;
  xmlString = "<item>\n<description>Widget</description>\n<price>500.0</price>\n" +
    "<quantity>" + quantity + "</quantity></item>";
  InputSource xmlStream = new InputSource(new StringReader(xmlString));

  // Build a validating SAX parser using our schema
  SchemaFactory sf = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
  DefaultHandler defHandler = new DefaultHandler() {
      public void warning(SAXParseException s) throws SAXParseException {throw s;}
      public void error(SAXParseException s) throws SAXParseException {throw s;}
      public void fatalError(SAXParseException s) throws SAXParseException {throw s;}
    };
  StreamSource ss = new StreamSource(new File("schema.xsd"));
  try {
    Schema schema = sf.newSchema(ss);
    SAXParserFactory spf = SAXParserFactory.newInstance();
    spf.setSchema(schema);
    SAXParser saxParser = spf.newSAXParser();
    // To set the custom entity resolver, an XML reader needs to be created
    XMLReader reader = saxParser.getXMLReader(); 
    reader.setEntityResolver(new CustomResolver());
    saxParser.parse(xmlStream, defHandler);
  } catch (ParserConfigurationException x) {
    throw new IOException("Unable to validate XML", x);
  } catch (SAXException x) {
    throw new IOException("Invalid quantity", x);
  }

  // "<quantity>"Our +XML quantityis + "</quantity></item>";valid, proceed
  outStream.write(xmlString.getBytes());
  outStream.flush();
}

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="81f8410e50c69467-a083f90e-4045430b-a5d9b881-54fdd223592e24dc0b69a329"><ac:plain-text-body><![CDATA[

[[OWASP 2005

AA. Bibliography#OWASP 05]]

 

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="1fa45527929daad5-766f1486-4fd341cf-982498e2-078247e2976d6b9c3f90b0a1"><ac:plain-text-body><![CDATA[

[[OWASP 2007

AA. Bibliography#OWASP 07]]

 

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="51914f8a80d4a1fe-e2e25cf7-470c4309-a1acafa1-5e97d29a28e7a9ca10557d84"><ac:plain-text-body><![CDATA[

[[OWASP 2008

AA. Bibliography#OWASP 08]]

 

]]></ac:plain-text-body></ac:structured-macro>

Testing for XML Injection (OWASP-DV-008)

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="8341fa5cc179c798-7b120d19-4c3f4704-8c7fa883-893d19a2292b0ce6b3ded402"><ac:plain-text-body><![CDATA[

[[W3C 2008

AA. Bibliography#W3C 08]]

4.4.3 Included If Validating

]]></ac:plain-text-body></ac:structured-macro>

...