java - 无法解决java中的xml实体扩展问题

Question

我正在使用以下请求将数据发送到班级

<!DOCTYPE foo [
<!ENTITY xeebri2n3 "o16ja">]>
<SubmitPaymentRequest xmlns="http://www.qwest.com/XMLSchema" xmlns:bim="http://www.qwest.com/XMLSchema/BIM">
    <EPWFHeaderInfo>
        <bim:RequestId>IR1BCSRDQBSIRW7745 &xeebri2n3;&xeebri2n3;&xeebri2n3;</bim:RequestId>
        <bim:SendTimeStamp>2019-12-23T14:23:01.183-05:00</bim:SendTimeStamp>
        <bim:MessageSrcSystem>IPS</bim:MessageSrcSystem>
    </EPWFHeaderInfo>
</SubmitPaymentRequest >

我正在以字符串格式将 xml 请求传递给下面的代码，现在我希望在转换为 java 对象之前不使用所有 DOCTYPE 及其实体，并且我正在使用下面的代码来实现这一点，但无法解决问题实体值仍然是附加在数据字段中，因此攻击者仍然可以攻击代码所以有什么方法可以删除 doctype 和 entity 而不会引发异常并在没有任何 DOCTYPE 的情况下处理我的数据

class Parsing {

public static String formatXML(String s) {
        StringReader sr = null;
        StringWriter sw = null;
        Writer writer = null;
        try {
            t
            XMLReader reader = XMLReaderFactory.createXMLReader();
            //reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);                        
            reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
            reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
            reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
            Source xmlInput = new SAXSource(reader, new InputSource(new StringReader( s )));
            // sr = new StringReader(s);
             //Source xmlInput = new StreamSource(sr);
             sw = new StringWriter();
             StreamResult xmlOutput = new StreamResult(sw);
            
             // Configure transformer
             Transformer transformer =
             TransformerFactory.newInstance().newTransformer(); // An
            // identity
            // transformer
             transformer.setOutputProperty(OutputKeys.DOCTYPE_SYSTEM,
             "testing.dtd");
             transformer.setOutputProperty(OutputKeys.INDENT, "yes");
             transformer.setOutputProperty("{http://xml.apache.org/xslt}indent-amount",
             "4");
             transformer.transform(xmlInput, xmlOutput);
             writer = xmlOutput.getWriter();
             return writer.toString();
            
            
            
        } catch (Exception e) {
            logger.error("Caught exception", e);
        }
        finally{
        StringBuilder errMsg = new StringBuilder("Exception caught while closing");
        try{ if(sr != null) sr.close();}catch(Exception ie){logger.error(errMsg.append("StringReader").toString(),ie);}
        try{ if(sw != null)sw.close();}catch(IOException ie){logger.error(errMsg.append(" StringWriter").toString(),ie);}
        try{if(writer != null)writer.close();}catch(IOException ex){logger.error(errMsg.append("Writer"),ex);};
            
        }
        return s;
    }
}

标签： javaxmlsecurityxml-parsingfortify