SLazar147150 (Community Member) asked a question.
The method reporting flaw: CWE ID 611, uses a parameter passed in: Templates template
in order to create a new Transformer instance:
Transformer transformer = template.newTransformer() ...
Flaw is generated for "transformer.transform" call.
Many posts point at the fix with securing factory:
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
which works fine as long as factory, template and transformer are in same method context.
However with "Templates" passed in as parameter, even if template was produced from a secured factory, flaw is still generated.
Is flaw generated because this is a public api and Templates parameter cannot be verified? (as produced by a secured factory)
Is there a way avoid this flaw by "securing" transformer produced from Templates?
The method in question:
static public void applyTransform(Templates template, JAXBSource source,... Result result) {
Transformer transformer = null;
try {
transformer = template.newTransformer();
Source streamSource;
...
transformer.transform(streamSource, result); // CWE ID 611
thanks,
Stefan
.png){kind=logo}
Hi @SLazar147150 (Community Member),
Thanks for your question. The flaw could have been raised due to the public static nature of the applyTransform method. This will likely be the case if the method exists within a component of your application that has been selected as an entry-point on the Review Modules page. In this scenario Veracode would be reporting this flaw as though your offering (app) was a library for consumption by other teams for example. You may wish to review the module selection to ensure only those components of your application that directly interface with the outside-world are set as being entry points. You can learn more about entry-point selection in this community article: https://community.veracode.com/s/article/What-are-Modules-and-how-do-my-results-change-based-on-what-I-select. Alternatively you may wish to schedule a consultation to discuss this further. You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
If you have evaluated all usages of the method and verified they are all called from secure factories you may wish to propose a mitigation by design, evidencing the review you have carried out. The example you included matches the recommendation from this OWASP cheat sheet article: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#transformerfactory and so is a reasonable mitigating implementation at this time.
I hope that answers your question.
Thanks,
Anthony Fielding