From 338253fb0837a1005309be0e3f35244466083727 Mon Sep 17 00:00:00 2001 From: Eric Seokgon Lee Date: Thu, 3 Sep 2026 10:09:47 +0900 Subject: [PATCH] =?UTF-8?q?fix:=20QueryIdSearchJob=EC=9D=98=20XML=20?= =?UTF-8?q?=EC=99=B8=EB=B6=80=20=EC=97=94=ED=8B=B0=ED=8B=B0(XXE)=20?= =?UTF-8?q?=EC=B7=A8=EC=95=BD=EC=A0=90=20=EC=88=98=EC=A0=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 질의 ID 검색 시 워크스페이스 XML을 파싱하는 DocumentBuilderFactory에 외부 엔티티·외부 DTD 차단 설정을 추가한다. --- .../egovframework/dev/imp/dbio/search/QueryIdSearchJob.java | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/egovframework.dev.imp.dbio/src/egovframework/dev/imp/dbio/search/QueryIdSearchJob.java b/egovframework.dev.imp.dbio/src/egovframework/dev/imp/dbio/search/QueryIdSearchJob.java index acc5dccf..461c3427 100644 --- a/egovframework.dev.imp.dbio/src/egovframework/dev/imp/dbio/search/QueryIdSearchJob.java +++ b/egovframework.dev.imp.dbio/src/egovframework/dev/imp/dbio/search/QueryIdSearchJob.java @@ -248,6 +248,11 @@ private void searchInFile(IFile file) { InputStream stream = file.getContents(); DocumentBuilderFactory fact = DocumentBuilderFactory.newInstance(); fact.setValidating(false); + // XXE(XML External Entity Injection, CWE-611) 취약점 방지 + fact.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); + fact.setFeature("http://xml.org/sax/features/external-general-entities", false); + fact.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + fact.setXIncludeAware(false); DocumentBuilder builder = fact.newDocumentBuilder(); builder.setEntityResolver(new EntityResolver() { @Override