Tukukkk

I looked for similar posts on this blog, but couldn't find an answer to my question, so I decided to ask for help.

I wrote this simple function in Java:

 public void open(InputStream stream) throws FoliumFatalException {

        try {

            InputSource is = new InputSource(stream);

            DocumentBuilderFactory dfact = DocumentBuilderFactory.newInstance();



//            /* OWASP: inhibit access to External Entities */

            dfact.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); 

            dfact.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); 



            _doc = dfact.newDocumentBuilder().parse(is);



        } catch (Throwable t) {

            _logger.error(t, t);

            throw new FoliumFatalException("ENG-0017", "Errore di parsing su stream", t);

        }



    }

My goal is applying OWASP standards as exposed here, but I get the following error:

 java.lang.IllegalArgumentException: Property 'http://javax.xml.XMLConstants/property/accessExternalDTD' is not recognized.

java.lang.IllegalArgumentException: Property 'http://javax.xml.XMLConstants/property/accessExternalDTD' is not recognized.

    at org.apache.xerces.jaxp.DocumentBuilderFactoryImpl.setAttribute(Unknown Source) ~[xercesImpl-2.8.0.jar:?]

    at agora.folium.engine.impl.j2ee.FoliumJ2eeXmlParserImpl.open(FoliumJ2eeXmlParserImpl.java:108) [classes/:?]

    at agora.folium.engine.impl.FoliumAbstractEngine.loadServices(FoliumAbstractEngine.java:268) [classes/:?]

    at agora.folium.engine.impl.j2ee.FoliumJ2eeEngineImpl.startup(FoliumJ2eeEngineImpl.java:110) [classes/:?]

    at agora.folium.engine.Folium.startup(Folium.java:258) [classes/:?]

    at agora.folium.control.impl.j2ee.FoliumActionServlet.init(FoliumActionServlet.java:94) [classes/:?]

    at org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1230) [catalina.jar:7.0.85]

    at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1174) [catalina.jar:7.0.85]

    at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:1066) [catalina.jar:7.0.85]

    at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:5370) [catalina.jar:7.0.85]

    at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5668) [catalina.jar:7.0.85]

    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:145) [catalina.jar:7.0.85]

    at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:1015) [catalina.jar:7.0.85]

    at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:991) [catalina.jar:7.0.85]

    at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652) [catalina.jar:7.0.85]

    at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:712) [catalina.jar:7.0.85]

    at org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:2002) [catalina.jar:7.0.85]

    at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:1.8.0_141]

    at java.util.concurrent.FutureTask.run(Unknown Source) [?:1.8.0_141]

    at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:1.8.0_141]

    at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:1.8.0_141]

    at java.lang.Thread.run(Unknown Source) [?:1.8.0_141]

I'm using Eclipse Oxygen, Tomcat 7 and Java 1.8.
Can anyone help me?

Thanks for your support.

Apache Xerces-J 2.12.0 and earlier implement older versions of JAXP that do not support either of the properties that you are trying to set. To block access to external entities, you could write an EntityResolver (that always throws a SAXException) and register that EntityResolver with the DocumentBuilder. See documentation here [1].

[1] http://xerces.apache.org/xerces2-j/javadocs/api/javax/xml/parsers/DocumentBuilder.html#setEntityResolver(org.xml.sax.EntityResolver)