RRoy Moulick393155 (Community Member) asked a question.
CWE - 502 Deserialization of Untrusted Data Fix For JAVA Code
Hi everybody,
I got cwe 502 flaw in a code snippet like below -
MyBean result = (MyBean) new Unmarshaller.unmarshal(InputSource ref);
As I am using xml input I am trying to parse my request with xml input stream using jaxbcontext. But unfortunately I can't fetch the actual String xml from the Input Source object. Could anybody please share some java code snippet to resolve this veracode flaw for unmarshslling the InputSource reference. Thanks in advance.
With Warm Regards,
Ritesh
.png){kind=logo}
Looping in the June Secure Coding Challenge (which focuses on Insecure Deserialization) winners @C-Rod (Community Member) @snieguu (Community Member) !
Cris, Damian - do you want to take a stab? 🤓
Yes @Shuning
//Disable XXE
SAXParserFactory spf = SAXParserFactory.newInstance();
spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
//Do unmarshal operation
Source xmlSource = new SAXSource(spf.newSAXParser().getXMLReader(),
new InputSource(new StringReader(xml)));
JAXBContext jc = JAXBContext.newInstance(Object.class);
Unmarshaller um = jc.createUnmarshaller();
MyBean result = (MyBean) um.unmarshal(xmlSource);
See reference https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxb-unmarshaller
Regards,
Damian
Thank you @snieguu (Community Member) for the suggestion!
@RRoy Moulick393155 (Community Member) - let us know if this helps!
Hello Everybody,
Thank you @snieguu (Community Member) for your suggestion and @shuning (Community Manager) for helping me.
In my application I am using org.exolab.castor Mapping to fetch data from my custom mapping xml and by loading that mapping data I am trying to deserialize my InputSource (converted from input string xml) and eventually type casting that to a specific type of my RequestBean. For this deserialization purpose I am using org.exolab.castor Unmarshaller. Also my request bean class to which I am trying to put data after deserialization is an abstract class.
I have also used org.exolab.castor.xml.XmlContext to set false above mentioned three parameters to disable XXE. After that I have created my Unmarshaller by invoking createUnmarshaller() from that xmlContext, but still have no luck.
Unfortunately, still I am not able to solve this issue, Could anybody please help me on this.
Thanks in advance.
With Warm Regards,
Ritesh
Hello everybody, can anybody have some idea on this. I am still sticking with the same issue. Please check my above comment and let me know how can I solve this flaw in my castor generated xml mapping deserialization.
Thanks, Ritesh
Hey hope it's not too late, but for JAXB this is how I set up my unmarshalling:
@GetMapping("/action")
@ResponseBody
public String action(@RequestParam("xml") String xml) throws JAXBException, XMLStreamException {
PurchaseOrder purchaseOrder = (PurchaseOrder) secureUnmarshaller(new ByteArrayInputStream(xml.getBytes()), PurchaseOrder.class);
return gson.toJson(purchaseOrder);
}
private Object secureUnmarshaller(InputStream inputStream, Class objClass) throws XMLStreamException, JAXBException {
JAXBContext jaxbContext = JAXBContext.newInstance(objClass);
XMLInputFactory xif = XMLInputFactory.newFactory();
xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
xif.setProperty(XMLInputFactory.SUPPORT_DTD, false);
XMLStreamReader xsr = xif.createXMLStreamReader(inputStream);
Unmarshaller unmarshaller = jaxbContext.createUnmarshaller();
return unmarshaller.unmarshal(xsr);
}