JAXP 1.3 and DoS attacks

Posted by Andrea Nasato Sun, 13 Nov 2005 07:36:00 GMT

One of the new aspects introduced in JAXP 1.3 is the opportunity to specify the security level of the SaxParser used. The target of this feature is to prevent the application from DoS (Denial of Service) attacks, which use some vulnerabilities of XML. There are two main attack categories, let’s see them:

  1. Entity Resolution: suppose that XML stream requires a DTD and this DTD is in an external server and not local to your application. The parser requests the DTD to the server, which can send the DTD slowly or can give it malformed: in this case the parsing stops indefinitely. The solution to this problem is to set to a false value these properties:
    • parser.setFeature(   "http://xml.org/sax/features/external-general-entities",   false)
    • parser.setFeature(   "http://xml.org/sax/features/external-parameter-entities",   false)
    In this way the parser doesn’t call the external server to resolve the DTD.
  2. Overflow attack: XML doesn’t give a limit to the number of attributes of an element, and to the length of an element name. Overflow attacks start from this observation, and their objective is stop the server from fulfilling other requests: if the parser uses the DOM API it maintains a tree representation of XML in memory. When the parser encounters such XML streams it starts allocating objects for each attribute, saturating server memory. If you have such a problem and you use JAXP 1.3 you can set this property: http://javax.xml.XMLConstants/feature/secure-processing. With this property set, your parser rejects this kind of XML streams. You can have notification of such event in the fatalError method of the handler registered with the parser.

So if your boss is paranoid, or if your services could effectively be attacked in such a way, use JAXP 1.3 and those simple rules. If you want more information about JAXP 1.3, this is a good link. For a complete description of DoS attacks with XML this is a good tutorial.

Posted in  | Tags  | 1 comment


Posted by Lucio Benfante Fri, 11 Nov 2005 18:49:00 GMT

One of the traits I personally appreciate most in a good programmer is what I call the “constructive laziness”. It is the attitude to build software solutions for avoiding boring activities.

One of the most frequent and boring activities happening in the writing of a Java class is the implementation of the toString method, especially if the class contains lot of attributes and if it is frequently updated.

Last summer, in a mood of constructive laziness than surely doesn’t make me a good programmer, I wrote a small class library that tries to solve this problem. Using such library you can write a toString method as simple as the following:

public String toString() { ToStringHelper.toString(this); }


Posted in  | 38 comments

Older posts: 1 ... 12 13 14