documentbuilderfactory-external-parameter-entities-true-java

Author: Sakshis

rules/java/security/documentbuilderfactory-external-parameter-entities-true-java.yml

@@ -0,0 +1,13 @@
+id: documentbuilderfactory-external-parameter-entities-true-java
+severity: warning
+language: java
+message: >-
+      External entities are allowed for $DBFACTORY. This is vulnerable to XML
+      external entity attacks. Disable this by setting the feature
+      "http://xml.org/sax/features/external-parameter-entities" to false.
+note: >-
+  [CWE-611] Improper Restriction of XML External Entity Reference.
+  [REFERENCES]
+      - https://blog.sonarsource.com/secure-xml-processor
+rule:
+  pattern: $DBFACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities",true);

tests/__snapshots__/documentbuilderfactory-external-parameter-entities-true-java-snapshot.yml

@@ -0,0 +1,16 @@
+id: documentbuilderfactory-external-parameter-entities-true-java
+snapshots:
+  ? |
+    dbf.setFeature("http://xml.org/sax/features/external-parameter-entities" , true);
+  : labels:
+    - source: dbf.setFeature("http://xml.org/sax/features/external-parameter-entities" , true);
+      style: primary
+      start: 0
+      end: 81
+  ? |
+    spf.setFeature("http://xml.org/sax/features/external-parameter-entities" , true);
+  : labels:
+    - source: spf.setFeature("http://xml.org/sax/features/external-parameter-entities" , true);
+      style: primary
+      start: 0
+      end: 81

tests/java/documentbuilderfactory-external-parameter-entities-true-java-test.yml

@@ -0,0 +1,9 @@
+id: documentbuilderfactory-external-parameter-entities-true-java
+valid:
+  - |
+    dbf.setFeature("http://xml.org/sax/features/external-parameter-entities" , false);
+invalid:
+  - |
+    dbf.setFeature("http://xml.org/sax/features/external-parameter-entities" , true);
+  - |
+    spf.setFeature("http://xml.org/sax/features/external-parameter-entities" , true);