Parser Wrapper Class for Secure XML Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
XML parser systems are vulnerable to attacks such as XXE and XML bombs, which can lead to resource consumption, data disclosure, and remote system access, as they lack configuration options to prevent such threats, especially when processing XML documents from untrusted sources.
Innovation Solution
A parser wrapper class object intercepts and selects an appropriate XML parser based on its attributes and features, using a trusted entity resolver and mapping to secure the parsing process, thereby preventing malicious attacks by hardening the parser and validating XML schema definitions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If XML parser follows XML specifications by default, then parsing functionality is complete and versatile, but system becomes vulnerable to XXE attacks and XML bomb attacks
Solution Approach 1:
The patent introduces a wrapper class as an intermediary layer between the application and the XML parser. This wrapper intercepts parser instantiation calls and configures security features (disabling external entities, DTD processing, and XML bombs protection) before the parser processes the XML document, thus protecting against XXE and XML bomb attacks while maintaining parsing functionality
Solution Approach 2:
The wrapper class performs preliminary security configuration before the XML parsing process begins. It pre-configures the parser with secure settings (disabling external entities, DTD, and entity expansion) in advance, ensuring that the parser is hardened against attacks before processing any potentially malicious XML content
2Reliability
If parser configuration is restricted to prevent attacks, then security is improved, but parsing adaptability and functionality are reduced
Solution Approach 1:
The wrapper class serves as a mediator that provides secure parser configuration while maintaining parsing functionality. It selectively enables necessary parsing features while disabling only the dangerous ones (external entities, DTD processing), thus achieving a balance between security and functionality
Solution Approach 2:
The patent applies security restrictions locally to specific parser features rather than globally disabling all functionality. It selectively disables only the vulnerable features (external entities, DTD, entity expansion) while leaving other parsing functionalities intact, thus maintaining parsing adaptability while improving security
3Adaptability or versatility
If parser processes XML from untrusted sources, then system handles diverse input, but resource consumption increases due to attacks
Solution Approach 1:
The wrapper class performs preliminary security configuration before XML processing, disabling features that could lead to resource exhaustion attacks. By pre-configuring the parser to reject external entities and limit entity expansion, it prevents XML bomb attacks from consuming excessive CPU and memory resources
Data Source
AI summary
A system, a method, a device, and a computer program product for parsing a document are provided. A processing instance for parsing by at least one parsing module in a plurality of parsing modules is generated. The generated processing instance is intercepted. Based on the intercepted generated processing instance, a parsing module is selected. Using the selected parsing module, the processing instance is parsed to generate a parsed processing instance.