rixxc/KeePassDX
1
0
Fork 0
mirror of https://github.com/Kunzisoft/KeePassDX.git synced 2025-12-04 15:49:33 +01:00
Code Issues Packages Projects Releases Wiki Activity

Try to prevent XXE #200

Browse Source
This commit is contained in:
J-Jamet
2019-10-06 10:25:13 +02:00
parent fcc29f67a3
commit 99917c7f28
1 changed files with 16 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
app/src/main/java/com/kunzisoft/keepass/database/element/PwDatabaseV4.kt
View File

@@ -37,7 +37,9 @@ import java.io.InputStream
import java.security.MessageDigest
import java.security.NoSuchAlgorithmException
import java.util.*
import javax.xml.XMLConstants
import javax.xml.parsers.DocumentBuilderFactory
import javax.xml.parsers.ParserConfigurationException
class PwDatabaseV4 : PwDatabase<UUID, PwGroupV4, PwEntryV4> {
@@ -290,16 +292,24 @@ class PwDatabaseV4 : PwDatabase<UUID, PwGroupV4, PwEntryV4> {
override fun loadXmlKeyFile(keyInputStream: InputStream): ByteArray? {
try {
val dbf = DocumentBuilderFactory.newInstance()
val db = dbf.newDocumentBuilder()
val doc = db.parse(keyInputStream)
val documentBuilderFactory = DocumentBuilderFactory.newInstance()
val el = doc.documentElement
if (el == null || !el.nodeName.equals(RootElementName, ignoreCase = true)) {
// Disable certain unsecure XML-Parsing DocumentBuilderFactory features
try {
documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)
} catch (e : ParserConfigurationException) {
Log.e(TAG, "Unable to add FEATURE_SECURE_PROCESSING to prevent XML eXternal Entity injection (XXE)", e)
}
val documentBuilder = documentBuilderFactory.newDocumentBuilder()
val doc = documentBuilder.parse(keyInputStream)
val docElement = doc.documentElement
if (docElement == null || !docElement.nodeName.equals(RootElementName, ignoreCase = true)) {
return null
}
val children = el.childNodes
val children = docElement.childNodes
if (children.length < 2) {
return null
}