CVE-2021-33813 - issue

[coolmg]

Hi,

I have written sample code using the latest JDOM 2.0.6.1 version. But I still see the issue
Please see my code and suggest the solution for it.

String xmlParam =
            "<!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY bar \"World \"> <!ENTITY t1 \"&bar;&bar;\"><!ENTITY t2 \"&t1;&t1;&t1;&t1;\">  <!ENTITY t3 \"&t2;&t2;&t2;&t2;&t2;\">]><foo>Hello &t3;</foo>";

@GetMapping("/testxml") public String test_SAXBuilder() throws IOException {
String xmlParam =
" ]>Hello &t3;";

    String result = null;
    try {
        // disallow-doctype-decl is set to true and after parsing will hold value true
        SAXBuilder builder = new SAXBuilder();
        Document doc = builder.build(new InputSource(new StringReader(xmlParam)));
        String s = "";
        for (Object content1 : doc.getContent()) {
            Content content = (Content) content1;
            s += content.getValue();
        }
        result = s;
    } catch (JDOMException e) {
    }
    return result;
}

Output:
Hello World World World World World World World World World World World World World World World World World World World World World World World World World World World World World World World World World World World World World World World World

[Jason Hunter]

Where are you actually changing the SAX parser settings?

[coolmg]

No seethings added, above one is complete code.
Do we need to add any extra code to fix it?

[Jason Hunter]

builder.setExpandEntities(false) will stop external entity expansion

[coolmg]

Thanks