XXE prevention with RestTemplate SpringBoot 2.3.3

119 Views Asked by At

I am working on spring boot 2.3.3. and restTemplate. Below is the piece of code for fetching an XML:

RestTemplate rt = new RestTemplate(); rt.exchange(baseURL + path, HttpMethod.GET, httpEntity, classObj);

I have test case with a sample XML and DOCTYPE that should fail in parsing, but it doesn't. Rest template seems to be parsing the XML properly. XML :

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE MyResponse SYSTEM "http://example.com:8080/some/path/MyResponse.dtd">
<ABC xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
 <XYZ>
 </XYZ>
</ABC>

If I add entities to the XML, the parsing fails with OOM error.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE lolz [<!ENTITY lol 'lol'><!ENTITY lol1 '&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;'><!ENTITY lol2 '&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;'><!ENTITY lol3 '&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;'><!ENTITY lol4 '&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;'><!ENTITY lol5 '&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;'><!ENTITY lol6 '&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;'><!ENTITY lol7 '&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;'><!ENTITY lol8 '&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;'><!ENTITY lol9 '&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;'>]><lolz>&lol9;</lolz>
<ABC xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
 <XYZ>
 </XYZ>
</ABC>

How can I prevent restTemplate from parsing the doctype. When I run the test in debug mode, I can see that Jaxb2RootElementHttpMessageConverter in restTemplate has isSupportDtd set to false already, which doesn't seem to be working.

0

There are 0 best solutions below