标签 Apache Struts 下的文章
Apache Struts S2-069 XXE漏洞(CVE-2025-68493)复现
public static Document parse(InputSource inputSource) {
return parse(inputSource, null);
}
parse(InputSource inputSource, Map<String, String> dtdMappings) {
SAXParserFactory factory = null;
String parserProp = System.getProperty("xwork.saxParserFactory");
if (parserProp != null) {
try {
ObjectFactory objectFactory = ActionContext.getContext().getContainer().getInstance(ObjectFactory.class);
Class clazz = objectFactory.getClassInstance(parserProp);
factory = (SAXParserFactory) clazz.newInstance();
} catch (Exception e) {
LOG.error("Unable to load saxParserFactory set by system property 'xwork.saxParserFactory': {}", parserProp, e);
}
}
if (factory == null) {
factory = SAXParserFactory.newInstance(); // 使用默认 SAXParserFactory
}
factory.setValidating((dtdMappings != null));
factory.setNamespaceAware(true);
SAXParser parser;
try {
parser = factory.newSAXParser();
} catch (Exception ex) {
throw new StrutsException("Unable to create SAX parser", ex);
}
DOMBuilder builder = new DOMBuilder();
// Enhance the sax stream with location information
ContentHandler locationHandler = new LocationAttributes.Pipe(builder);
try {
parser.parse(inputSource, new StartHandler(locationHandler, dtdMappings));
} catch (Exception ex) {
throw new StrutsException(ex);
}
return builder.getDocument();
}
