Avatar

Please consider registering
guest

sp_LogInOut Log In sp_Registration Register

Register | Lost password?
Advanced Search

— Forum Scope —




— Match —





— Forum Options —





Minimum search word length is 3 characters - maximum search word length is 84 characters

sp_Feed Topic RSS sp_TopicIcon
XmlElement containing DOCTYPE
April 12, 2019
13:02, EEST
Avatar
reinhard
Member
Members
Forum Posts: 11
Member Since:
December 6, 2016
sp_UserOfflineSmall Offline

We transmit XML data to our OPC server via a method, containing a XmlElement parameter.

The XML data also contains a DOCTYPE, so we are getting error messages like this:
“DOCTYPE is disallowed when the feature “http://apache.org/xml/features/disallow-doctype-decl” set to true. “

How can we set “http://apache.org/xml/features/disallow-doctype-decl” to “false” ?

April 12, 2019
14:40, EEST
Avatar
Bjarne Boström
Moderator
Moderators
Forum Posts: 336
Member Since:
April 3, 2012
sp_UserOfflineSmall Offline

Hi,

This has been intentionally disabled due to prevent attacks: https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.md#java (starting from https://downloads.prosysopc.com/opcua/Prosys_OPC_UA_Java_SDK_3_Release_Notes.html#version-3-1-4)

Therefore I highly recommend not to allow that and fix the client sending the data to not send that. If you are sure data only comes from trusted sources (and that they got it from trusted sources etc.), this should allow it:

XMLFactoryCache.getDocumentBuilderFactory().setFeature(“http://apache.org/xml/features/disallow-doctype-decl”, false);

You might need to do others as well (see the owasp site linked above). Do this at the start of main before interacting with SDK code.

Forum Timezone: Europe/Helsinki

Most Users Ever Online: 78

Currently Online:
10 Guest(s)

Currently Browsing this Page:
1 Guest(s)

Top Posters:

hbrackel: 89

pramanj: 86

ibrahim: 68

kapsl: 57

gjevremovic: 49

TimK: 41

Fransua33: 39

fred: 36

Rainer Versteeg: 32

vonGohren: 25

Member Stats:

Guest Posters: 0

Members: 815

Moderators: 11

Admins: 1

Forum Stats:

Groups: 3

Forums: 14

Topics: 841

Posts: 3556

Newest Members:

waldlatscher, keithwalmar, shanjaved, opcua-user, DmitryPervukhin, DPer, YeaTeshy, marttin, bouncycastlerentals, Sayan B

Moderators: Jouni Aro: 824, Otso Palonen: 32, Tuomas Hiltunen: 5, janimakela: 0, Pyry: 1, Terho: 0, Petri: 0, Bjarne Boström: 336, Heikki Tahvanainen: 402, Jukka Asikainen: 1, Teppo Uimonen: 14

Administrators: admin: 0