codeql/java/ql/test/query-tests/security/CWE-611/SchemaTests.java at aa267c83027a8216cfaf4e4b7fbe33e5c9ebcc02 · github/codeql · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
import java.net.Socket;

import javax.xml.XMLConstants;
import javax.xml.transform.stream.StreamSource;
import javax.xml.validation.Schema;
import javax.xml.validation.SchemaFactory;

public class SchemaTests {

  public void unconfiguredSchemaFactory(Socket sock) throws Exception {
    SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");
    Schema schema = factory.newSchema(new StreamSource(sock.getInputStream())); //unsafe
  }

  public void safeSchemaFactory(Socket sock) throws Exception {
    SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");
    factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
    factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
    Schema schema = factory.newSchema(new StreamSource(sock.getInputStream())); //safe
  }

  public void partialConfiguredSchemaFactory1(Socket sock) throws Exception {
    SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");
    factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
    Schema schema = factory.newSchema(new StreamSource(sock.getInputStream())); //unsafe
  }

  public void partialConfiguredSchemaFactory2(Socket sock) throws Exception {
    SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");
    factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
    Schema schema = factory.newSchema(new StreamSource(sock.getInputStream())); //unsafe
  }

  public void misConfiguredSchemaFactory1(Socket sock) throws Exception {
    SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");
    factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
    factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "ab");
    Schema schema = factory.newSchema(new StreamSource(sock.getInputStream())); //unsafe
  }

  public void misConfiguredSchemaFactory2(Socket sock) throws Exception {
    SchemaFactory factory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");
    factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "cd");
    factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
    Schema schema = factory.newSchema(new StreamSource(sock.getInputStream())); //unsafe
  }
}