fix(core): added fix for xml parser (#3100)

* added fix for xml parser vulnerability * added fix for xml parser vulnerability Co-authored-by: Banji Jolaoso <[email protected]>
aws-amplify · Dec 5, 2022 · c3e6d69 · c3e6d69
1 parent cfcce40
commit c3e6d69
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 4 deletions.
diff --git a/aws-android-sdk-core/src/main/java/com/amazonaws/regions/RegionMetadataParser.java b/aws-android-sdk-core/src/main/java/com/amazonaws/regions/RegionMetadataParser.java
@@ -109,9 +109,10 @@ private static List<Region> internalParse(
         Document document;
         try {
 
-            DocumentBuilderFactory factory =
-                    DocumentBuilderFactory.newInstance();
-
+            DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+            factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+            factory.setXIncludeAware(false);
+            factory.setExpandEntityReferences(false);
             DocumentBuilder documentBuilder = factory.newDocumentBuilder();
             document = documentBuilder.parse(input);
 

diff --git a/aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java b/aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java
@@ -45,7 +45,25 @@ public class XpathUtils {
     /** Shared logger */
     private static Log log = LogFactory.getLog(XpathUtils.class);
 
-    private static DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+    private static DocumentBuilderFactory factory = getDocumentBuilderFactory();
+
+
+    /**
+     * Creates new documentbuilderfactory object
+     * @return DocumentBuilderFactory.
+     */
+    private static DocumentBuilderFactory getDocumentBuilderFactory() {
+        try {
+            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+            dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+            dbf.setXIncludeAware(false); // Default false for java 8. Disable XML Inclusions leading to SSRF - https://portswigger.net/web-security/xxe/lab-xinclude-attack
+            dbf.setExpandEntityReferences(false);
+            return dbf;
+        }
+        catch (ParserConfigurationException exception){
+            return null;
+        }
+    }
 
     /**
      * InputStream to Document.