Identified a checkmarx vulnerability

[Purnaank]

We are using custom antisamy library, which overrides some features of this library. However we have kept most of the classes and its functionality same as the actual library.

On running a checkmarx scan on it, a MEDIUM level vulnerability has been identified. Below is the description of the same.

             **Source**	                                                        **Destination**

File src/main/java/org/owasp/validator/html/
scan/AntiSamySAXScanner.java src/main/java/org/owasp/validator/html/
scan/AntiSamySAXScanner.java

Line 81 237

Object getProperty transform

Improper Restriction of Stored XXE Ref\Path 1:
The scan loads and parses XML using transform, at line 206 of
src/main/java/org/owasp/validator/html/scan/AntiSamySAXScanner.java. This XML was
constructed based on stored data, getProperty, which was read from the database or a file at
line 69 of src/main/java/org/owasp/validator/html/scan/AntiSamySAXScanner.java. Note that
transform is set to automatically load and replace any DTD entity references in the XML,
including references to external files.

We would appreciate your feedback and inputs on the same.

We are planning to remove the flexibility to provide the implementation of TransformerFactory at startup using System.getProperty(). Instead we will keep it hard-coded and will force to use the same default Implementation (com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl) every time.

[davewichers]

There is one similar warning from SpotBugs in AntiSamy, but since the method is private and AntiSamy itself is providing the XML as a bundled resource, we trust the XML, so we are not concerned. Where is your XML coming from? Do you trust it? If not, you might have to tweak the code with the issue to prevent XXE, assuming that tweak doesn't break how you are using the XML.

[Purnaank]

Thank you for the response.
The incoming XML is from an un-trusted source.
We will tweak the code accordingly to prevent XXE.

[kwwall]

@davewichers - I think you should close this issue, as no fix is necessary to AntiSamy since this was a custom implementation.

[davewichers]

Closing this issue as it's a conversation about a customized fork of AntiSamy, not the version we maintain.