Package io.github.pixee.security

Class DocumentBuilderFactorySecurity

java.lang.Object

io.github.pixee.security.DocumentBuilderFactorySecurity

public final class DocumentBuilderFactorySecurity
extends Object

This type exposes helper methods that will help defend against XXE attacks in DocumentBuilderFactory.

For more on XXE:

https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html

Method Summary

Modifier and Type	Method	Description
static DocumentBuilderFactory	hardenDocumentBuilderFactory(DocumentBuilderFactory factory, boolean expandEntityReferences, boolean allowXinclude)	Harden the DocumentBuilderFactory against XML-based attacks, and promote directly to the API forefront the decision to allow dangerous XML features.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

hardenDocumentBuilderFactory

public static DocumentBuilderFactory hardenDocumentBuilderFactory(DocumentBuilderFactory factory,
                                                                  boolean expandEntityReferences,
                                                                  boolean allowXinclude)

Harden the DocumentBuilderFactory against XML-based attacks, and promote directly to the API forefront the decision to allow dangerous XML features.

Parameters:

factory - the factory requiring hardening

expandEntityReferences - a parameter which will be passed to DocumentBuilderFactory.setExpandEntityReferences(boolean)

allowXinclude - parameter which will be passed to DocumentBuilderFactory.setXIncludeAware(boolean)

Returns:

a factory that is hardened against XML attacks (e.g., XXE)