search

CycloneDX / cyclonedx-core-java

CycloneDX SBOM Model and Utils for Creating and Validating BOMs
https://cyclonedx.org/
Apache License 2.0
81 stars 59 forks source link

Fix possible XXE during XML schema version detection #434

Closed mr-zepol closed 3 months ago

mr-zepol commented 3 months ago

During some testing, it was found that the parser for XML was vulnerable to XML External Entity (XXE) Processing.

After further investigation from Sonatype team, it was found it was due to the XPath Processing done to get the schema version

mr-zepol commented 3 months ago

hey @nscuro for some reason I can't reply to your last comment, I can do this in a new PR, I want to focus this on the fix, and then we can add the option to set their on DocumentBuilderFactory but to be honest I find it useless, this is not to parse the file, this is to get the schema version, the actual process is done with Jackson

jkowalleck commented 3 months ago

fixes https://github.com/CycloneDX/cyclonedx-core-java/security/advisories/GHSA-683x-4444-jxh8