OpenSAML-Java susceptible to comment attack?

[Brent Putman]

On 2/27/18 11:02 PM, Marc Boorshtein wrote:
>
>
>     It does not. At least, not if you are using our ParserPool impl
>     with default settings.   We completely strip out the comments
>     when we parse the input into the DOM.  So there's never any
>     comments in the DOM.
>
>
> Hmm, looks like I'm using the raw javax.xml.parsers.DocumentBuilder
> and the comment issue is not handled properly.  Can you point me to
> some example code?  Looking at the Api docs all I see is
> GlobalParserPoolInitalizer but I don't see any actual parsers.
If you were grepping source code, etc, you might have missed it since
the ParserPool stuff is actual in our java-support library.  The sole
impl of the ParserPool interface is:
net.shibboleth.utilities.java.support.xml.BasicParserPool.  You would
just new an instance, set any properties you want and initialize(). 

For the default global ParserPool instance, after library init you can
get that from
org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport.getParserPool(). 
Currently the only difference from a vanilla BasicParserPool with no
changes is that it ups the maxPoolSize from 5 to 50.

However, the BasicParserPool is really mostly just a convenience
wrapper around use of DocumentBuilderFactory and DocumentBuilder, with
some defaults that differ from the standard Java defaults.  If you want
to use a DBF without our ParserPool stuff, all you need to do is set
the DocumentBuilderFactory ignoringComments property to 'true'.  That's
what the BasicParserPool does, nothing more than that.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20180301/df79639c/attachment.html>