Re: Fwd: XXE

2013-02-05 Thread Jon Gorrono
Hello, I am back again with a question from the POI team ... They use XMLBeans to generated a large number of classes that extend org.apache.xmlbeans.impl.values.XmlComplexContentImpl which seemed like a place to provide a custom XMLOptions with reader preferences for parsing since it can acc

Re: Fwd: XXE

2013-02-01 Thread Jon Gorrono
OK, thanks... that makes sense... ...the term 'feature' I was using from from xerces docs where they use to term to set parsing options on the SAX DocumentBuilderFactory here: http://xerces.apache.org/xerces2-j/features.html We've been able show that we can block the vector by setting the follow

Re: Fwd: XXE

2013-02-01 Thread Cezar Andrei
I'm not sure I understand exactly what you're looking for but I'll give it a try. It's possible to pass the exact XML parser that XMLBeans should use, see http://xmlbeans.apache.org/docs/2.6.0/reference/org/apache/xmlbeans/XmlOptions.html#setLoadUseXMLReader(org.xml.sax.XMLReader) and http://xmlbe