Skip to content

Commit 685c658

Browse files
JoyChou93JoyChou93
committed
add SAXReader && SAXBuilder
1 parent aa6116d commit 685c658

File tree

3 files changed

+215
-29
lines changed

3 files changed

+215
-29
lines changed

‎java-sec-code.iml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,8 @@
6060
<orderEntry type="library" name="Maven: mysql:mysql-connector-java:8.0.12" level="project" />
6161
<orderEntry type="library" name="Maven: com.google.protobuf:protobuf-java:2.6.0" level="project" />
6262
<orderEntry type="library" name="Maven: com.alibaba:fastjson:1.2.49" level="project" />
63+
<orderEntry type="library" name="Maven: org.jdom:jdom2:2.0.4" level="project" />
64+
<orderEntry type="library" name="Maven: org.dom4j:dom4j:2.1.1" level="project" />
6365
<orderEntry type="library" name="Maven: com.google.guava:guava:21.0" level="project" />
6466
<orderEntry type="library" name="Maven: commons-collections:commons-collections:3.1" level="project" />
6567
<orderEntry type="library" name="Maven: commons-lang:commons-lang:2.4" level="project" />

‎pom.xml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,22 @@
5757
<version>1.2.49</version>
5858
</dependency>
5959

60+
<!-- jdom解析xml 最新版本为2.0.6 时间为2015-02-28 https://github.com/hunterhacker/jdom/releases-->
61+
<!-- https://mvnrepository.com/artifact/org.jdom/jdom2 -->
62+
<dependency>
63+
<groupId>org.jdom</groupId>
64+
<artifactId>jdom2</artifactId>
65+
<version>2.0.6</version>
66+
</dependency>
67+
68+
<!-- https://mvnrepository.com/artifact/org.dom4j/dom4j -->
69+
<dependency>
70+
<groupId>org.dom4j</groupId>
71+
<artifactId>dom4j</artifactId>
72+
<version>2.1.1</version>
73+
</dependency>
74+
75+
6076
<!-- 获取url根域名-->
6177
<dependency>
6278
<groupId>com.google.guava</groupId>

‎src/main/java/org/joychou/controller/XXE.java‎

Lines changed: 197 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package org.joychou.controller;
22

33

4+
import org.dom4j.io.SAXReader;
45
import org.springframework.stereotype.*;
56
import org.springframework.web.bind.annotation.*;
67
import javax.servlet.http.HttpServletRequest;
@@ -17,6 +18,8 @@
1718
import javax.xml.parsers.SAXParser;
1819
import org.xml.sax.helpers.DefaultHandler;
1920
import org.apache.commons.digester3.Digester;
21+
import org.jdom2.input.SAXBuilder;
22+
2023

2124
/**
2225
* @author: JoyChou ([email protected])
@@ -35,16 +38,104 @@ public String xxe_xmlReader(HttpServletRequest request) {
3538
String xml_con = getBody(request);
3639
System.out.println(xml_con);
3740
XMLReader xmlReader = XMLReaderFactory.createXMLReader();
41+
xmlReader.parse( new InputSource(new StringReader(xml_con)) ); // parse xml
42+
return "ok";
43+
} catch (Exception e) {
44+
System.out.println(e);
45+
return "except";
46+
}
47+
}
3848

39-
// fix code start
4049

41-
// xmlReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
42-
// xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", false);
43-
// xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
50+
@RequestMapping(value = "/xmlReader_fix", method = RequestMethod.POST)
51+
@ResponseBody
52+
public String xxe_xmlReader_fix(HttpServletRequest request) {
53+
try {
54+
String xml_con = getBody(request);
55+
System.out.println(xml_con);
4456

57+
XMLReader xmlReader = XMLReaderFactory.createXMLReader();
58+
// fix code start
59+
xmlReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
60+
xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", false);
61+
xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
4562
//fix code end
46-
4763
xmlReader.parse( new InputSource(new StringReader(xml_con)) ); // parse xml
64+
65+
return "ok";
66+
} catch (Exception e) {
67+
System.out.println(e);
68+
return "except";
69+
}
70+
}
71+
72+
73+
@RequestMapping(value = "/SAXBuilder", method = RequestMethod.POST)
74+
@ResponseBody
75+
public String xxe_SAXBuilder(HttpServletRequest request) {
76+
try {
77+
String xml_con = getBody(request);
78+
System.out.println(xml_con);
79+
80+
SAXBuilder builder = new SAXBuilder();
81+
org.jdom2.Document document = builder.build( new InputSource(new StringReader(xml_con)) ); // case xxe
82+
return "ok";
83+
} catch (Exception e) {
84+
System.out.println(e);
85+
return "except";
86+
}
87+
}
88+
89+
@RequestMapping(value = "/SAXBuilder_fix", method = RequestMethod.POST)
90+
@ResponseBody
91+
public String xxe_SAXBuilder_fix(HttpServletRequest request) {
92+
try {
93+
String xml_con = getBody(request);
94+
System.out.println(xml_con);
95+
96+
SAXBuilder builder = new SAXBuilder();
97+
builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
98+
builder.setFeature("http://xml.org/sax/features/external-general-entities", false);
99+
builder.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
100+
org.jdom2.Document document = builder.build( new InputSource(new StringReader(xml_con)) );
101+
102+
return "ok";
103+
} catch (Exception e) {
104+
System.out.println(e);
105+
return "except";
106+
}
107+
}
108+
109+
@RequestMapping(value = "/SAXReader", method = RequestMethod.POST)
110+
@ResponseBody
111+
public String xxe_SAXReader(HttpServletRequest request) {
112+
try {
113+
String xml_con = getBody(request);
114+
System.out.println(xml_con);
115+
116+
SAXReader reader = new SAXReader();
117+
org.dom4j.Document document = reader.read( new InputSource(new StringReader(xml_con)) ); // case xxe
118+
119+
return "ok";
120+
} catch (Exception e) {
121+
System.out.println(e);
122+
return "except";
123+
}
124+
}
125+
126+
@RequestMapping(value = "/SAXReader_fix", method = RequestMethod.POST)
127+
@ResponseBody
128+
public String xxe_SAXReader_fix(HttpServletRequest request) {
129+
try {
130+
String xml_con = getBody(request);
131+
System.out.println(xml_con);
132+
133+
SAXReader reader = new SAXReader();
134+
reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
135+
reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
136+
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
137+
org.dom4j.Document document = reader.read( new InputSource(new StringReader(xml_con)) );
138+
48139
return "ok";
49140
} catch (Exception e) {
50141
System.out.println(e);
@@ -58,16 +149,30 @@ public String xxe_SAXParser(HttpServletRequest request) {
58149
try {
59150
String xml_con = getBody(request);
60151
System.out.println(xml_con);
152+
61153
SAXParserFactory spf = SAXParserFactory.newInstance();
154+
SAXParser parser = spf.newSAXParser();
155+
parser.parse(new InputSource(new StringReader(xml_con)), new DefaultHandler()); // parse xml
62156

63-
// fix code start
157+
return "test";
158+
} catch (Exception e) {
159+
System.out.println(e);
160+
return "except";
161+
}
162+
}
64163

65-
// spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
66-
// spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
67-
// spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
68164

69-
// fix code end
165+
@RequestMapping(value = "/SAXParser_fix", method = RequestMethod.POST)
166+
@ResponseBody
167+
public String xxe_SAXParser_fix(HttpServletRequest request) {
168+
try {
169+
String xml_con = getBody(request);
170+
System.out.println(xml_con);
70171

172+
SAXParserFactory spf = SAXParserFactory.newInstance();
173+
spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
174+
spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
175+
spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
71176
SAXParser parser = spf.newSAXParser();
72177
parser.parse(new InputSource(new StringReader(xml_con)), new DefaultHandler()); // parse xml
73178
return "test";
@@ -77,52 +182,83 @@ public String xxe_SAXParser(HttpServletRequest request) {
77182
}
78183
}
79184

185+
80186
@RequestMapping(value = "/Digester", method = RequestMethod.POST)
81187
@ResponseBody
82188
public String xxe_Digester(HttpServletRequest request) {
83189
try {
84190
String xml_con = getBody(request);
85191
System.out.println(xml_con);
86-
Digester digester = new Digester();
87192

88-
// fix code start
193+
Digester digester = new Digester();
194+
digester.parse(new StringReader(xml_con)); // parse xml
89195

90-
// digester.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
91-
// digester.setFeature("http://xml.org/sax/features/external-general-entities", false);
92-
// digester.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
196+
return "test";
197+
} catch (Exception e) {
198+
System.out.println(e);
199+
return "except";
200+
}
201+
}
93202

94-
// fix code end
203+
@RequestMapping(value = "/Digester_fix", method = RequestMethod.POST)
204+
@ResponseBody
205+
public String xxe_Digester_fix(HttpServletRequest request) {
206+
try {
207+
String xml_con = getBody(request);
208+
System.out.println(xml_con);
95209

210+
Digester digester = new Digester();
211+
digester.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
212+
digester.setFeature("http://xml.org/sax/features/external-general-entities", false);
213+
digester.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
96214
digester.parse(new StringReader(xml_con)); // parse xml
215+
97216
return "test";
98217
} catch (Exception e) {
99218
System.out.println(e);
100219
return "except";
101220
}
102221
}
103222

104-
105223
@RequestMapping(value = "/DocumentBuilder", method = RequestMethod.POST)
106224
@ResponseBody
107225
public String xxe_DocumentBuilder(HttpServletRequest request) {
108226
try {
109227
String xml_con = getBody(request);
110228
System.out.println(xml_con);
229+
111230
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
231+
DocumentBuilder db = dbf.newDocumentBuilder();
232+
StringReader sr = new StringReader(xml_con);
233+
InputSource is = new InputSource(sr);
234+
Document document = db.parse(is); // parse xml
235+
sr.close();
112236

113-
// fix code start
237+
return "test";
238+
} catch (Exception e) {
239+
System.out.println(e);
240+
return "except";
241+
}
242+
}
114243

115-
// dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
116-
// dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
117-
// dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
118244

119-
// fix code end
245+
@RequestMapping(value = "/DocumentBuilder_fix", method = RequestMethod.POST)
246+
@ResponseBody
247+
public String xxe_DocumentBuilder_fix(HttpServletRequest request) {
248+
try {
249+
String xml_con = getBody(request);
250+
System.out.println(xml_con);
120251

252+
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
253+
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
254+
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
255+
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
121256
DocumentBuilder db = dbf.newDocumentBuilder();
122257
StringReader sr = new StringReader(xml_con);
123258
InputSource is = new InputSource(sr);
124259
Document document = db.parse(is); // parse xml
125260
sr.close();
261+
126262
return "test";
127263
} catch (Exception e) {
128264
System.out.println(e);
@@ -137,19 +273,50 @@ public String xxe_xinclude_DocumentBuilder(HttpServletRequest request) {
137273
try {
138274
String xml_con = getBody(request);
139275
System.out.println(xml_con);
140-
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
141276

277+
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
142278
dbf.setXIncludeAware(true); // 支持XInclude
143279
dbf.setNamespaceAware(true); // 支持XInclude
280+
DocumentBuilder db = dbf.newDocumentBuilder();
281+
StringReader sr = new StringReader(xml_con);
282+
InputSource is = new InputSource(sr);
283+
Document document = db.parse(is); // parse xml
144284

145-
// fix code start
285+
NodeList rootNodeList = document.getChildNodes();
286+
287+
for (int i = 0; i < rootNodeList.getLength(); i++) {
288+
Node rootNode = rootNodeList.item(i);
289+
NodeList xxe = rootNode.getChildNodes();
290+
for (int j = 0; j < xxe.getLength(); j++) {
291+
Node xxeNode = xxe.item(j);
292+
// 测试不能blind xxe，所以强行加了一个回显
293+
System.out.println("xxeNode: " + xxeNode.getNodeValue());
294+
}
146295

147-
// dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
148-
// dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
149-
// dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
296+
}
150297

151-
// fix code end
298+
sr.close();
299+
return "test";
300+
} catch (Exception e) {
301+
System.out.println(e);
302+
return "except";
303+
}
304+
}
152305

306+
307+
@RequestMapping(value = "/DocumentBuilder_xinclude_fix", method = RequestMethod.POST)
308+
@ResponseBody
309+
public String xxe_xinclude_DocumentBuilder_fix(HttpServletRequest request) {
310+
try {
311+
String xml_con = getBody(request);
312+
System.out.println(xml_con);
313+
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
314+
315+
dbf.setXIncludeAware(true); // 支持XInclude
316+
dbf.setNamespaceAware(true); // 支持XInclude
317+
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
318+
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
319+
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
153320
DocumentBuilder db = dbf.newDocumentBuilder();
154321
StringReader sr = new StringReader(xml_con);
155322
InputSource is = new InputSource(sr);
@@ -162,7 +329,8 @@ public String xxe_xinclude_DocumentBuilder(HttpServletRequest request) {
162329
NodeList xxe = rootNode.getChildNodes();
163330
for (int j = 0; j < xxe.getLength(); j++) {
164331
Node xxeNode = xxe.item(j);
165-
System.out.println("xxeNode: " + xxeNode.getNodeValue()); // 回显
332+
// 测试不能blind xxe，所以强行加了一个回显
333+
System.out.println("xxeNode: " + xxeNode.getNodeValue());
166334
}
167335

168336
}

0 commit comments

Comments
 (0)