微信支付XXE xml外部实体主图漏洞

[sitaluo]

No description provided.

[sitaluo]

看了下，源代码中已经做了处理了。

public final class XmlStream {
private final static String ROOT_ELEMENT_XML = "xml";
private final static String XML_VERSION = "1.0";
private final static ConcurrentHashMap<Class, JAXBContext> jaxbContexts = new ConcurrentHashMap, JAXBContext>();
private final static SAXParserFactory spf = SAXParserFactory.newInstance();
static {
try {
spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
} catch (Exception e) {
;
}
}

按照微信给的demo比较好少了一个：
setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);