...
Code Block | ||
---|---|---|
| ||
private void createXMLStream(BufferedOutputStream outStream, String quantity) throws IOException { String xmlString; xmlString = "<item>\n<description>Widget</description>\n<price>500.0</price>\n" + "<quantity>" + quantity + "</quantity></item>"; outStream.write(xmlString.getBytes()); outStream.flush(); } |
...
Code Block | ||
---|---|---|
| ||
private void createXMLStream(BufferedOutputStream outStream, String quantity) throws IOException { // Write XML string if quantity contains numbers only (whitelisting) // Blacklisting of invalid characters can also be done in conjunction if (!Pattern.matches("[0-9]+", quantity)) { // Format violation } String xmlString = "<item>\n<description>Widget</description>\n<price>500</price>\n" + "<quantity>" + quantity + "</quantity></item>"; outStream.write(xmlString.getBytes()); outStream.flush(); } |
Compliant Solution (XML Schema)
A more general mechanism for checking XML for attempted injection is to validate it using a DTD or schema. The schema must be rigidly defined to prevent injections from being mistaken for valid XML. Here is a suitable schema for validating our XML snippet:
Code Block | ||
---|---|---|
| ||
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
<xs:element name="item">
<xs:complexType>
<xs:sequence>
<xs:element name="description" type="xs:string"/>
<xs:element name="price" type="xs:decimal"/>
<xs:element name="quantity" type="xs:integer"/>
</xs:sequence>
</xs:complexType>
</xs:element>
</xs:schema>
|
This compliant code example employs this schema to prevent XML injection from succeeding. The schema is avaialble as the file schema.xsd
.
Code Block | ||
---|---|---|
| ||
private void createXMLStream(BufferedOutputStream outStream, String quantity) throws IOException { String xmlString; xmlString = "<item>\n<description>Widget</description>\n<price>500.0</price>\n" + "<quantity>" + quantity + "</quantity></item>"; InputSource xmlStream = new InputSource(new StringReader(xmlString)); // Build a validating SAX parser using our schema SchemaFactory sf = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); DefaultHandler defHandler = new DefaultHandler() { public void warning(SAXParseException s) throws SAXParseException {throw s;} public void error(SAXParseException s) throws SAXParseException {throw s;} public void fatalError(SAXParseException s) throws SAXParseException {throw s;} }; StreamSource ss = new StreamSource(new File("schema.xsd")); try { Schema schema = sf.newSchema(ss); SAXParserFactory spf = SAXParserFactory.newInstance(); spf.setSchema(schema); SAXParser saxParser = spf.newSAXParser(); // To set the custom entity resolver, an XML reader needs to be created XMLReader reader = saxParser.getXMLReader(); reader.setEntityResolver(new CustomResolver()); saxParser.parse(xmlStream, defHandler); } catch (ParserConfigurationException x) { throw new IOException("Unable to validate XML", x); } catch (SAXException x) { throw new IOException("Invalid quantity", x); } // "<quantity>"Our +XML quantityis + "</quantity></item>";valid, proceed outStream.write(xmlString.getBytes()); outStream.flush(); } |
...
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="81f8410e50c69467-a083f90e-4045430b-a5d9b881-54fdd223592e24dc0b69a329"><ac:plain-text-body><![CDATA[ | [[OWASP 2005 | AA. Bibliography#OWASP 05]] |
| ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="1fa45527929daad5-766f1486-4fd341cf-982498e2-078247e2976d6b9c3f90b0a1"><ac:plain-text-body><![CDATA[ | [[OWASP 2007 | AA. Bibliography#OWASP 07]] |
| ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="51914f8a80d4a1fe-e2e25cf7-470c4309-a1acafa1-5e97d29a28e7a9ca10557d84"><ac:plain-text-body><![CDATA[ | [[OWASP 2008 | AA. Bibliography#OWASP 08]] |
| ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="8341fa5cc179c798-7b120d19-4c3f4704-8c7fa883-893d19a2292b0ce6b3ded402"><ac:plain-text-body><![CDATA[ | [[W3C 2008 | AA. Bibliography#W3C 08]] | 4.4.3 Included If Validating | ]]></ac:plain-text-body></ac:structured-macro> |
...