杰克斯
您可以通过
XMLStreamReader将
IS_SUPPORTING_EXTERNAL_ENTITIES和和/或
XMLInputFactory.SUPPORT_DTD属性设置为的取消编组，以防止Xml
eXternal Entity（XXE）攻击
false。
JAX-WS
JAX-WS实现应为您解决这一问题。如果没有，我建议针对特定的实现打开一个错误。
例
演示版
package xxe;import javax.xml.bind.*;import javax.xml.stream.*;import javax.xml.transform.stream.StreamSource;public class Demo { public static void main(String[] args) throws Exception { JAXBContext jc = JAXBContext.newInstance(Customer.class); XMLInputFactory xif = XMLInputFactory.newFactory(); xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); xif.setProperty(XMLInputFactory.SUPPORT_DTD, false); XMLStreamReader xsr = xif.createXMLStreamReader(new StreamSource("src/xxe/input.xml")); Unmarshaller unmarshaller = jc.createUnmarshaller(); Customer customer = (Customer) unmarshaller.unmarshal(xsr); Marshaller marshaller = jc.createMarshaller(); marshaller.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, true); marshaller.marshal(customer, System.out); }}input.xml
该XML文档包含一个实体，该实体已设置为获取我用来创建此示例的文件列表。
<?xml version="1.0"?><!DOCTYPE customer[<!ENTITY name SYSTEM "/Users/bdoughan/Examples/src/xxe/">]><customer> <name>&name;</name></customer>
顾客
package xxe;import javax.xml.bind.annotation.XmlRootElement;@XmlRootElementpublic class Customer { private String name; public String getName() { return name; } public void setName(String name) { this.name = name; }}输出-默认配置
默认情况下，实体将被解析。
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><customer> <name>Customer.javaDemo.javainput.xml</name></customer>
XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES
属性设置为时输出false
设置此属性后，不会解析该实体。
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><customer> <name></name></customer>
XMLInputFactory.SUPPORT_DTD
属性设置为时输出false
设置此属性后，将尝试抛出异常来解析该实体。
Exception in thread "main" javax.xml.bind.UnmarshalException - with linked exception:[javax.xml.stream.XMLStreamException: ParseError at [row,col]:[8,15]Message: The entity "name" was referenced, but not declared.] at com.sun.xml.bind.v2.runtime.unmarshaller.UnmarshallerImpl.handleStreamException(UnmarshallerImpl.java:436) at com.sun.xml.bind.v2.runtime.unmarshaller.UnmarshallerImpl.unmarshal0(UnmarshallerImpl.java:372) at com.sun.xml.bind.v2.runtime.unmarshaller.UnmarshallerImpl.unmarshal(UnmarshallerImpl.java:342) at xxe.Demo.main(Demo.java:18)Caused by: javax.xml.stream.XMLStreamException: ParseError at [row,col]:[8,15]Message: The entity "name" was referenced, but not declared. at com.sun.org.apache.xerces.internal.impl.XMLStreamReaderImpl.next(XMLStreamReaderImpl.java:598) at com.sun.xml.bind.v2.runtime.unmarshaller.StAXStreamConnector.bridge(StAXStreamConnector.java:196) at com.sun.xml.bind.v2.runtime.unmarshaller.UnmarshallerImpl.unmarshal0(UnmarshallerImpl.java:370) ... 2 more
