Skip to content

Repository navigation

Harden Aviator FPR XML parsing against XXE #1123

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rsenden merged 4 commits into from
Oct 5, 2026
Merged

Harden Aviator FPR XML parsing against XXE #1123

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f9d45f5
chore: Add tests to prevent XXE vulnerabilities in XML processing and…
kireetivar Oct 1, 2026
0d2b951
chore: Update preview descriptions for apply-remediations in Aviator …
kireetivar Oct 1, 2026
31ad4fb
chore: Update preview descriptions for apply-remediations in Aviator …
kireetivar Oct 1, 2026
ecfc271
chore: Align Aviator XML parser security settings
kireetivar Oct 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions ...-aviator-common/src/main/java/com/fortify/cli/aviator/dast/StreamingWebInspectParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@

import com.fortify.cli.aviator._common.exception.AviatorTechnicalException;
import com.fortify.cli.aviator.util.FprHandle;
import com.fortify.cli.common.util.SecureXmlParserFactory;

/**
* Streaming (StAX-based) parser for WebInspect XML files contained in DAST FPR files.
Expand All @@ -48,9 +49,7 @@ public class StreamingWebInspectParser {

public StreamingWebInspectParser(FprHandle fprHandle) {
this.fprHandle = fprHandle;
this.xmlInputFactory = XMLInputFactory.newInstance();
xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
this.xmlInputFactory = SecureXmlParserFactory.newXmlInputFactory();
}

/**
Expand Down
17 changes: 3 additions & 14 deletions ...core/fcli-aviator-common/src/main/java/com/fortify/cli/aviator/dast/WebInspectParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,9 +21,7 @@
import java.util.Base64;
import java.util.List;

import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;

import org.slf4j.Logger;
Expand All @@ -34,6 +32,7 @@
import org.xml.sax.SAXException;

import com.fortify.cli.aviator.util.FprHandle;
import com.fortify.cli.common.util.SecureXmlParserFactory;

/**
* Parser for WebInspect XML files contained in DAST FPR files.
Expand Down Expand Up @@ -62,7 +61,7 @@ public List<DastIssue> parse() {
}

try (InputStream inputStream = Files.newInputStream(webInspectPath)) {
DocumentBuilderFactory factory = createSecureDocumentBuilderFactory();
var factory = SecureXmlParserFactory.newDocumentBuilderFactory(false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document document = builder.parse(inputStream);

Expand Down Expand Up @@ -114,7 +113,7 @@ public List<DastSession> parseSessions() {
}

try (InputStream inputStream = Files.newInputStream(webInspectPath)) {
DocumentBuilderFactory factory = createSecureDocumentBuilderFactory();
var factory = SecureXmlParserFactory.newDocumentBuilderFactory(false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document document = builder.parse(inputStream);

Expand Down Expand Up @@ -432,14 +431,4 @@ private String stripHtmlTags(String html) {
.trim();
}

private DocumentBuilderFactory createSecureDocumentBuilderFactory() throws ParserConfigurationException {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setXIncludeAware(false);
factory.setExpandEntityReferences(false);
return factory;
}
}
15 changes: 3 additions & 12 deletions fcli-core/fcli-aviator-common/src/main/java/com/fortify/cli/aviator/fpr/model/FPRInfo.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@
import java.util.Optional;

import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.stream.XMLInputFactory;
import javax.xml.stream.XMLStreamConstants;
import javax.xml.stream.XMLStreamException;
Expand All @@ -36,6 +35,7 @@
import com.fortify.cli.aviator.fpr.filter.FilterTemplate;
import com.fortify.cli.aviator.util.FprHandle;
import com.fortify.cli.aviator.util.StringUtil;
import com.fortify.cli.common.util.SecureXmlParserFactory;

import lombok.Getter;
import lombok.Setter;
Expand Down Expand Up @@ -80,10 +80,7 @@ private void extractInfoFromAuditFvdlStreaming(FprHandle fprHandle) {
throw new AviatorTechnicalException("audit.fvdl not found in FPR: " + fprHandle.getFprPath());
}

XMLInputFactory factory = XMLInputFactory.newInstance();
// Security: Disable external entity processing
factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
XMLInputFactory factory = SecureXmlParserFactory.newXmlInputFactory();

try (InputStream inputStream = Files.newInputStream(auditPath)) {
XMLStreamReader reader = factory.createXMLStreamReader(inputStream);
Expand Down Expand Up @@ -187,13 +184,7 @@ private void extractInfoFromAuditFvdl(FprHandle fprHandle) throws Exception {
throw new AviatorTechnicalException("audit.fvdl not found in FPR: " + fprHandle.getFprPath());
}

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setXIncludeAware(false);
factory.setExpandEntityReferences(false);
factory.setValidating(false);
var factory = SecureXmlParserFactory.newDocumentBuilderFactory(false);
DocumentBuilder builder = factory.newDocumentBuilder();

Document auditDoc;
Expand Down
16 changes: 3 additions & 13 deletions fcli-core/fcli-aviator-common/src/main/java/com/fortify/cli/aviator/fpr/model/Node.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,9 +21,7 @@
import java.util.Optional;
import java.util.regex.Pattern;

import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;

import org.w3c.dom.Document;
import org.w3c.dom.Element;
Expand All @@ -33,6 +31,7 @@
import com.fortify.cli.aviator.fpr.filter.FilterTemplate;
import com.fortify.cli.aviator.fpr.utils.Searchable;
import com.fortify.cli.aviator.util.StringUtil;
import com.fortify.cli.common.util.SecureXmlParserFactory;

import lombok.Getter;
import lombok.Setter;
Expand Down Expand Up @@ -320,13 +319,7 @@ private void extractInfoFromAuditFvdl(Path extractedPath) throws Exception {
throw new IllegalStateException("audit.fvdl not found in " + extractedPath);
}

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setFeature("http://xml.org/sax/features/validation", false);
var factory = SecureXmlParserFactory.newDocumentBuilderFactory(false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document auditDoc = builder.parse(auditPath.toFile());

Expand Down Expand Up @@ -365,10 +358,7 @@ private void extractInfoFromAuditFvdlStreaming(Path extractedPath) throws Except
throw new IllegalStateException("audit.fvdl not found in " + extractedPath);
}

javax.xml.stream.XMLInputFactory factory = javax.xml.stream.XMLInputFactory.newInstance();
// Security: Disable external entity processing
factory.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
factory.setProperty(javax.xml.stream.XMLInputFactory.SUPPORT_DTD, false);
var factory = SecureXmlParserFactory.newXmlInputFactory();

try (java.io.InputStream inputStream = Files.newInputStream(auditPath)) {
javax.xml.stream.XMLStreamReader reader = factory.createXMLStreamReader(inputStream);
Expand Down
38 changes: 5 additions & 33 deletions ...li-aviator-common/src/main/java/com/fortify/cli/aviator/fpr/processor/AuditProcessor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,6 @@

import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
import javax.xml.transform.OutputKeys;
import javax.xml.transform.Transformer;
Expand Down Expand Up @@ -69,6 +68,7 @@
import com.fortify.cli.aviator.util.Constants;
import com.fortify.cli.aviator.util.FileUtil;
import com.fortify.cli.aviator.util.FprHandle;
import com.fortify.cli.common.util.SecureXmlParserFactory;

import lombok.Setter;

Expand Down Expand Up @@ -149,14 +149,7 @@ public Map<String, AuditIssue> processAuditXML() throws AviatorTechnicalExceptio
logger.debug("audit.xml not found. Creating a default audit.xml.");
auditDoc = createDefaultAuditXml();
} else {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setXIncludeAware(false);
factory.setExpandEntityReferences(false);
factory.setNamespaceAware(true);
var factory = SecureXmlParserFactory.newDocumentBuilderFactory(true);
DocumentBuilder builder = factory.newDocumentBuilder();

try (InputStream auditStream = Files.newInputStream(auditPath)) {
Expand Down Expand Up @@ -184,14 +177,7 @@ public Map<String, AuditIssue> processAuditXML() throws AviatorTechnicalExceptio

private Document createDefaultAuditXml() throws AviatorTechnicalException {
try {
DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
docFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
docFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
docFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
docFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
docFactory.setXIncludeAware(false);
docFactory.setExpandEntityReferences(false);
docFactory.setNamespaceAware(true);
var docFactory = SecureXmlParserFactory.newDocumentBuilderFactory(true);

DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
Document doc = docBuilder.newDocument();
Expand Down Expand Up @@ -925,14 +911,7 @@ private Document generateRemediationsXml(Map<String, AuditResponse> auditRespons
FPRInfo fprInfo, FVDLMetadata fvdlMetadata,
Map<String, Integer> skippedByReason) throws AviatorTechnicalException {
try {
DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
docFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
docFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
docFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
docFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
docFactory.setXIncludeAware(false);
docFactory.setExpandEntityReferences(false);
docFactory.setNamespaceAware(true);
var docFactory = SecureXmlParserFactory.newDocumentBuilderFactory(true);
DocumentBuilder docBuilder = docFactory.newDocumentBuilder();

Document finalDoc = docBuilder.newDocument();
Expand Down Expand Up @@ -1176,14 +1155,7 @@ public void warning(org.xml.sax.SAXParseException e) {
private boolean isRemediationElementValid(Element remediationElement, FPRInfo fprInfo) {
String instanceId = remediationElement.getAttribute("instanceId");
try {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setXIncludeAware(false);
factory.setExpandEntityReferences(false);
factory.setNamespaceAware(true);
var factory = SecureXmlParserFactory.newDocumentBuilderFactory(true);
DocumentBuilder builder = factory.newDocumentBuilder();
Document tempDoc = builder.newDocument();

Expand Down
5 changes: 2 additions & 3 deletions ...cli-aviator-common/src/main/java/com/fortify/cli/aviator/fpr/processor/FVDLProcessor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@
import com.fortify.cli.aviator.fpr.utils.XmlUtils;
import com.fortify.cli.aviator.util.FprHandle;
import com.fortify.cli.aviator.util.StringUtil;
import com.fortify.cli.common.util.SecureXmlParserFactory;

import jakarta.xml.bind.JAXBContext;
import jakarta.xml.bind.JAXBException;
Expand Down Expand Up @@ -129,9 +130,7 @@ private FVDL unmarshalFVDL(Path fvdlFilePath) throws JAXBException, IOException
try (InputStream fis = Files.newInputStream(fvdlFilePath)) {
JAXBContext jaxbContext = JAXBContext.newInstance(FVDL.class);
Unmarshaller unmarshaller = jaxbContext.createUnmarshaller();
javax.xml.stream.XMLInputFactory xmlInputFactory = javax.xml.stream.XMLInputFactory.newInstance();
xmlInputFactory.setProperty(javax.xml.stream.XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
xmlInputFactory.setProperty(javax.xml.stream.XMLInputFactory.SUPPORT_DTD, false);
var xmlInputFactory = SecureXmlParserFactory.newXmlInputFactory();
javax.xml.stream.XMLStreamReader xmlStreamReader = xmlInputFactory.createXMLStreamReader(fis);
return (FVDL) unmarshaller.unmarshal(xmlStreamReader);
} catch (javax.xml.stream.XMLStreamException e) {
Expand Down
11 changes: 2 additions & 9 deletions ...ator-common/src/main/java/com/fortify/cli/aviator/fpr/processor/FilterTemplateParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,6 @@

import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.transform.OutputKeys;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerFactory;
Expand All @@ -49,6 +48,7 @@
import com.fortify.cli.aviator.fpr.filter.TagValue;
import com.fortify.cli.aviator.util.Constants;
import com.fortify.cli.aviator.util.FprHandle;
import com.fortify.cli.common.util.SecureXmlParserFactory;

public class FilterTemplateParser {

Expand All @@ -72,14 +72,7 @@ public Optional<FilterTemplate> parseFilterTemplate() {
return Optional.empty();
}

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setValidating(false);
factory.setNamespaceAware(true);
var factory = SecureXmlParserFactory.newDocumentBuilderFactory(true);

DocumentBuilder builder = factory.newDocumentBuilder();

Expand Down
6 changes: 2 additions & 4 deletions ...or-common/src/main/java/com/fortify/cli/aviator/fpr/processor/StreamingFVDLProcessor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@
import com.fortify.cli.aviator.fpr.utils.XmlUtils;
import com.fortify.cli.aviator.util.FprHandle;
import com.fortify.cli.aviator.util.StringUtil;
import com.fortify.cli.common.util.SecureXmlParserFactory;

import lombok.AllArgsConstructor;
import lombok.Getter;
Expand Down Expand Up @@ -84,10 +85,7 @@ public StreamingFVDLProcessor(FprHandle fprHandle, ISourceDecoder sourceDecoder)
this.vulnFinalizer = new VulnFinalizer();
this.fprHandle = fprHandle;
this.sourceFileMap = fprHandle.getSourceFileMap();
this.xmlInputFactory = XMLInputFactory.newInstance();
// Security: Disable external entity processing
xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
this.xmlInputFactory = SecureXmlParserFactory.newXmlInputFactory();
this.fvdlMetadata = new FVDLMetadata();
// Same metadata instance FileUtils will see once encodings are registered during parse.
this.fileUtils = new FileUtils(
Expand Down
10 changes: 2 additions & 8 deletions .../main/java/com/fortify/cli/aviator/fpr/remediation/xmlprocessor/RemediationXmlReader.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,6 @@
import java.nio.file.Path;

import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;

import org.slf4j.Logger;
Expand All @@ -27,20 +26,15 @@
import org.xml.sax.SAXException;

import com.fortify.cli.aviator._common.exception.AviatorTechnicalException;
import com.fortify.cli.common.util.SecureXmlParserFactory;

/** Phase 1: parses {@code remediations.xml} into a DOM {@link Document}. No mapping, no business logic. */
public final class RemediationXmlReader {
private static final Logger LOG = LoggerFactory.getLogger(RemediationXmlReader.class);

public Document read(Path remediationPath) {
try (InputStream remediationStream = Files.newInputStream(remediationPath)) {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setNamespaceAware(true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setXIncludeAware(false);
factory.setExpandEntityReferences(false);
var factory = SecureXmlParserFactory.newDocumentBuilderFactory(true);
DocumentBuilder builder = factory.newDocumentBuilder();
return builder.parse(remediationStream);
} catch (ParserConfigurationException | SAXException | IOException e) {
Expand Down
15 changes: 2 additions & 13 deletions fcli-core/fcli-aviator-common/src/main/java/com/fortify/cli/aviator/util/FprHandle.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,7 @@
import java.util.regex.Pattern;
import java.util.stream.Stream;

import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;

import org.slf4j.Logger;
Expand All @@ -38,6 +36,7 @@

import com.fortify.cli.aviator._common.exception.AviatorSimpleException;
import com.fortify.cli.aviator._common.exception.AviatorTechnicalException;
import com.fortify.cli.common.util.SecureXmlParserFactory;

import lombok.Getter;

Expand Down Expand Up @@ -195,17 +194,7 @@ private Map<String, String> loadSourceFileMap() {

private void loadEntryXmlFormat(byte[] indexBytes, Map<String, String> map)
throws ParserConfigurationException, IOException, SAXException {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setFeature("http://xml.org/sax/features/validation", false);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
factory.setXIncludeAware(false);
factory.setExpandEntityReferences(false);
var factory = SecureXmlParserFactory.newDocumentBuilderFactoryWithoutDoctype(false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document indexDoc = builder.parse(new ByteArrayInputStream(indexBytes));

Expand Down
Loading
Loading