Date: Tue, 3 Jun 2014 08:27:47 -0700 From: Tim <tim-security@...tinelchicken.org> To: oss-security@...ts.openwall.com Subject: Re: CVE-2014-0191 libxml2: external parameter entity loaded when entity substitution is disabled Hi Tomas, Thanks for looking into this. Sorry for the slow reply. > As far as I can see setExpandEntityReferences() controls what value is > set for the create-entity-ref-nodes DOM parser feature: > > http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/file/cae04d181428/src/com/sun/org/apache/xerces/internal/jaxp/DocumentBuilderImpl.java#l158 > http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/file/cae04d181428/src/com/sun/org/apache/xerces/internal/jaxp/DocumentBuilderImpl.java#l74 > http://hg.openjdk.java.net/jdk7u/jdk7u/jaxp/file/cae04d181428/src/com/sun/org/apache/xerces/internal/impl/Constants.java#l427 > > The description in Java API docs is rather brief, xerces docs have more > details: > > http://xerces.apache.org/xerces-j/features.html#create-entity-ref-nodes > http://xerces.apache.org/xerces2-j/features.html#dom.create-entity-ref-nodes > > AFAICS, the feature does not aim to control if entity references are > expanded, but only how exactly they appear in the resulting DOM tree. Ok, that makes sense. Of course it is pointless for security if it doesn't affect parameter entities. I also find it odd that one of the only standard methods available to directly tweak entity behavior can only be implemented by setting a feature in Xerces that is non-standard. > Maybe your paper should rather mention parser features as > external-general-entities and external-parameter-entities: > > http://docs.oracle.com/javase/7/docs/api/org/xml/sax/package-summary.html#package_description I do mention the specific features that one needs to disable in order to make parsing safe. However, I didn't realize that that some of these features were standardized. Still, it would be quite confusing to any developer that doesn't spend extensive amounts of time researching each XML feature and understanding what needs to be turned off. > OWASP XXE document covers some of this, but actually mentions only one > of the two features... > > https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing#Java I did end up releasing my paper recently, which I believe has up-to-date recommendations for Xerces: http://vsecurity.com/download/papers/XMLDTDEntityAttacks.pdf Best, tim
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.