2

My application uses JDK6. I have to fix the XXE vulnerability in my code, able to find solution as below. But the below code works only with JDK7. I have a limitation to fix this without upgrading to JDK7. The code I found as fix is

TransformerFactory tf = TransformerFactory.newInstance(); tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");

So far I tried to use the following code. But it did not fix the issue.

TransformerFactory tf = TransformerFactory.newInstance(); tf.setAttribute(XMLConstants.FEATURE_SECURE_PROCESSING, true);

Radhakrishna Sharma Gorenta
  • 1,498
  • 2
  • 12
  • 26
  • Have you found any workaround? i am facing similar issue.. i am on java8 but `treansformerFactoryImpl` is injected from `xalan` jar which does not support `ACCESS_EXTERNAL_DTD` – Naveen Jan 13 '21 at 11:31

0 Answers0