RDasgupta150901 (Community Member) asked a question.
Veracode static report showing below highlighted line as vulnerable.
StreamSource json = new StreamSource(stream);
JAXBContext jc = JAXBContext.newInstance(className);
Unmarshaller unmarshaller = jc.createUnmarshaller();
unmarshaller.setProperty(UnmarshallerProperties.MEDIA_TYPE,
"application/json");
unmarshaller.setProperty(UnmarshallerProperties.JSON_INCLUDE_ROOT,
true);
unmarshaller.setProperty(
UnmarshallerProperties.JSON_ATTRIBUTE_PREFIX, "@");
obj = unmarshaller.unmarshal(json, className).getValue();
I've read the below OWASP cheatsheet but all the solution stated as xml as input. But in my case JSON is my input. Any leads how I can prevent XXE for JSON input while unmarshalling.
https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
.png){kind=logo}
Hi @RDasgupta150901 (Community Member) ,
As you will see from the JAXB Unmarshaller section of the cheatsheet the class does not support any flags for disabling XXE. I will check with Veracode Research to see whether the use of the MEDIA_TYPE is something that could be used to suppress a flaw being reported.
For now I would recommened you document this in a Mitigation by Design mitigation proposal and have it reviewed by your security team. Alternatively, you could change the code to use a JSON-specific unmarshaling library.
Best regards,
Duncan
Hi @RDasgupta150901 (Community Member) ,
Our Research team passed this over to Engineering, and an enhacement has been released. You should no longer see CWE-611 in this case.
Best regards,
Duncan