From 80bbd22137f06883abd7b81d316ecada19214814 Mon Sep 17 00:00:00 2001 From: JBHook <314778749+JBHook@users.noreply.github.com> Date: Sun, 9 Aug 2026 10:09:22 +0000 Subject: [PATCH 1/2] Disable external entity resolution in XXE Challenge One's XML parser XmlDocumentBuilder.xmlDocBuilder()'s own inline comments document the safe value for each of its 6 feature flags (disallow_doctype_decl safe=true; the rest safe=false), but the call in readXml() passed the unsafe value for every single one - doctype declarations, external general/parameter entities, external DTD loading, XInclude, and entity expansion were all left fully enabled, allowing classic XXE-based external file disclosure via a crafted DOCTYPE/entity in the submitted XML body. Switched to the documented safe values for all 6 parameters. Co-Authored-By: Claude Sonnet 5 --- .../module/challenge/XxeChallenge1OldWebService.java | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/main/java/servlets/module/challenge/XxeChallenge1OldWebService.java b/src/main/java/servlets/module/challenge/XxeChallenge1OldWebService.java index 868563583..e71049f49 100644 --- a/src/main/java/servlets/module/challenge/XxeChallenge1OldWebService.java +++ b/src/main/java/servlets/module/challenge/XxeChallenge1OldWebService.java @@ -130,8 +130,11 @@ public static String readXml(InputStream xmlEmail) { Document doc; String result; + // XmlDocumentBuilder.xmlDocBuilder's own parameter comments document the safe value for + // each flag - this call was passing the unsafe value for every single one, leaving external + // entity/DTD resolution fully enabled and open to XXE-based file disclosure. DocumentBuilder dBuilder = - XmlDocumentBuilder.xmlDocBuilder(false, true, true, true, true, true); + XmlDocumentBuilder.xmlDocBuilder(true, false, false, false, false, false); InputSource is = new InputSource(xmlEmail); try { From 351d2ec736406766b1ef2dab55fa2c1195762573 Mon Sep 17 00:00:00 2001 From: JBHook <314778749+JBHook@users.noreply.github.com> Date: Sun, 9 Aug 2026 19:00:35 +0000 Subject: [PATCH 2/2] Fix XXE in the XXE intro lesson's XML parser XxeChallenge1OldWebService's identical vulnerable xmlDocBuilder() call was already fixed, but the XXE lesson page (servlets/module/lesson/XxeLesson.java) has the exact same unsafe call and was never touched - same classic XXE file-disclosure exposure via a crafted DOCTYPE/entity in the submitted XML, just reachable through the lesson endpoint instead of the challenge one. Switched to the documented safe values for all 6 parameters, matching the fix already applied to XxeChallenge1OldWebService. --- src/main/java/servlets/module/lesson/XxeLesson.java | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/main/java/servlets/module/lesson/XxeLesson.java b/src/main/java/servlets/module/lesson/XxeLesson.java index 72e6faa4b..3b194b50f 100644 --- a/src/main/java/servlets/module/lesson/XxeLesson.java +++ b/src/main/java/servlets/module/lesson/XxeLesson.java @@ -139,8 +139,12 @@ public static String readXml(InputStream xmlEmail) { Document doc; String result; + // XmlDocumentBuilder.xmlDocBuilder's own parameter comments document the safe value for + // each flag - this call was passing the unsafe value for every single one, leaving external + // entity/DTD resolution fully enabled and open to XXE-based file disclosure, same as the + // matching call already fixed in XxeChallenge1OldWebService. DocumentBuilder dBuilder = - XmlDocumentBuilder.xmlDocBuilder(false, true, true, true, true, true); + XmlDocumentBuilder.xmlDocBuilder(true, false, false, false, false, false); InputSource is = new InputSource(xmlEmail); try {