An XML parser that fetches files
A hard Java puzzle in the security mistakes family. One line below contains a real bug. Try to spot it first, then read why it fails and how to fix it.
Highlighted: line 7. Play this one as a puzzle without the answer.
What is wrong
The default factory resolves external entities, so uploaded XML can declare an entity pointing at file:///etc/passwd or an internal URL and have the contents returned or fetched. This is an XML External Entity (XXE) attack.
The fix
How to avoid it next time
Disable DTDs and external entities on every XML parser that handles untrusted input.
Want the background? Read XML parsing: DOM, SAX, StAX in the Java concepts library.
About security mistakes
Predictable random numbers, secrets in source code, unvalidated file paths and weak hashes turn working features into vulnerabilities. They pass every functional test.
In code review: Search for java.util.Random in security contexts, literals that look like keys, paths built from user input, and MD5 or SHA-1 used for passwords.
More puzzles in this family
Frequently asked questions
What is the bug in "An XML parser that fetches files"?
The default factory resolves external entities, so uploaded XML can declare an entity pointing at file:///etc/passwd or an internal URL and have the contents returned or fetched. This is an XML External Entity (XXE) attack. The faulty line is line 7: DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
How do I fix it?
Replace it with: factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);. Disable DTDs and external entities on every XML parser that handles untrusted input.
How do I catch security mistakes in code review?
Search for java.util.Random in security contexts, literals that look like keys, paths built from user input, and MD5 or SHA-1 used for passwords.
Is there a new puzzle every day?
Yes. The daily Spot the Bug puzzle picks one of these snippets for each UTC day, with the difficulty set by the weekday. Your streak is stored only in your browser.