Description

Detects unsafe XML parsing configurations in Java applications using DOM4J library that could allow XML External Entity (XXE) attacks. When XML parsing is not properly configured with security controls, attackers can exploit XXE vulnerabilities to potentially disclose sensitive files, cause denial of service, or execute server-side request forgery attacks.

Detection Strategy

• Confirms the presence of DOM4J library imports (specifically org.dom4j.io package) in the Java source code

• Identifies direct calls to the 'read' method from SAXReader objects

• Reports a vulnerability when the SAXReader is used without enabling secure processing features or external entity restrictions

• Focuses on unsafe default configurations where XML parsing is done without explicit security controls

Vulnerable code example

import org.dom4j.Document;
import org.dom4j.io.SAXReader;
import javax.servlet.http.HttpServletRequest;

public void parseXmlUnsafe(HttpServletRequest request) throws Exception {
    // VULNERABLE: SAXReader without security features enables XXE attacks
    SAXReader reader = new SAXReader();
    Document doc = reader.read(request.getInputStream());...

✅ Secure code example

import org.dom4j.Document;
import org.dom4j.io.SAXReader;
import java.io.StringReader;

public void parseXmlSafe(String xmlInput) throws Exception {
    SAXReader reader = new SAXReader();
    // Disable DOCTYPE declarations to prevent XXE attacks
    reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);...