Can JAXB be configured to prevent entity expansion attacks?

Question

Normally when parsing XML in java, it's possible to avoid falling victim to entity expansion attacks by using

dbf.setFeature(javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true);

Where dbf is a DocumentBuilderFactory used to create DocumentBuilders for XML parsing.

However, suppose I am unmarshalling some XML using JAXB, e.g. like this:

  final JAXBContext context = JAXBContext.newInstance(MyClass.class);
  final Unmarshaller unmarshaller = context.createUnmarshaller();
  final MyClass result = (MyClass) unmarshaller.unmarshal(input);

How can I configure JAXB to use FEATURE_SECURE_PROCESSING on the underlying XML parser?

Googling for answers brings up the following as the best result: http://forums.java.net/node/699983

However, I don't want to have to bring in implementations of XMLStreamFactory and the like just to make entity expansion configurable. Is there a way to solve this problem using just the JAXB API?

Answer 1

Java SE 5 limits the number of entity expansions to 64,000:

• http://download.oracle.com/javase/1.5.0/docs/guide/xml/jaxp/JAXP-Compatibility_150.html#JAXP_security

I would expect that all JAXB implementations would leave this default protection in place. However if you want to be 100% sure you can create a SAXSource in the following way and have JAXB unmarshal that:

SAXParserFactory spf = SAXParserFactory.newInstance();
spf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
SAXParser sp = spf.newSAXParser();
XMLReader xmlReader = sp.getXMLReader();
SAXSource saxSource = new SAXSource(xmlReader, inputSource);

For more information see:

• http://bdoughan.blogspot.com/2011/03/preventing-entity-expansion-attacks-in.html