XXE 和十亿笑声

Question

使用 xmlpullfactory 是否可以实现 xxe 和十亿笑？我尝试过下面的 xml 代码

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE author [
<!ELEMENT author (#PCDATA)>
<!ENTITY js "Jo Smith">
]>
<author>&js;</author>

使用下面的java代码解析上面的xml文件，使用kxml2-2.3.0.jar

try
{
        XmlPullParserFactory factory =XmlPullParserFactory.newInstance();
        XmlPullParser parser = factory.newPullParser();
        File file=new File("index.xml");
        FileReader fileReader = new FileReader(file);
        BufferedReader bufferedReader = new BufferedReader(fileReader);
        StringBuffer stringBuffer = new StringBuffer();
        String line;
        while ((line = bufferedReader.readLine()) != null) {
            stringBuffer.append(line);
            stringBuffer.append("\n");
        }
        fileReader.close();
        parser.setFeature(XmlPullParser.FEATURE_PROCESS_NAMESPACES,true);
        parser.setInput( new StringReader(stringBuffer.toString()) );
        while (true) {
                 int event = parser.nextToken();
                 if (event == XmlPullParser.START_TAG) {
                     System.out.println("Start-tag: " + parser.getName()) ;
                 }
                 else if (event == XmlPullParser.END_TAG) {
                     System.out.println("End-tag: " + parser.getName());
                 }
                 else if (event == XmlPullParser.START_DOCUMENT) {
                     System.out.println("Start document: "  +
                     parser.getText());
                 }
                 else if (event == XmlPullParser.TEXT) {
                     System.out.println("Text: " + parser.getText());
                 }
                 else if (event == XmlPullParser.CDSECT) {
                     System.out.println("CDATA Section: " +     
                     parser.getText());
                 }
                 else if (event == XmlPullParser.COMMENT) {
                     System.out.println("Comment: " + parser.getText());
                 }
                 else if (event == XmlPullParser.DOCDECL) {
                     System.out.println("Document type declaration: " +    
                     parser.getText());
                 }
                 else if (event == XmlPullParser.ENTITY_REF) {
                     System.out.println("Entity Reference: " +   
                     parser.getName());
                     System.out.println("Entity Reference value: " +    
                     parser.getText());
                 }
                 else if (event == XmlPullParser.IGNORABLE_WHITESPACE) {
                     System.out.println("Ignorable white space: " + 
                     parser.getText());
                 }
                 else if (event == XmlPullParser.PROCESSING_INSTRUCTION)   
                 {
                     System.out.println("Processing Instruction: " +      
                     parser.getText());
                 }
                 else if (event == XmlPullParser.END_DOCUMENT) {
                     System.out.println("End Document: " +     
                     parser.getText());
                     break;
                 } // end else if
              }  // end while
    }
    catch(Exception e)
    {
        e.printStackTrace();
    }

输出为

可忽略的空白：

文档类型声明：

author [
<!ELEMENT author (#PCDATA)>
<!ENTITY js "Jo Smith">
]

可忽略的空白： 开始标签：作者

实体参考：js

实体参考值：空

结束标签：作者 可忽略的空白：

结束文档：空

但我想获取实体参考值作为 josmith。会有什么问题？

Answer 1

从 API 文档看来，您需要设置 FEATURE_PROCESS_DOCDECL 功能。