JAX-RPC 和 Axis2 是否可以防止 XML 注入？
JAX-RPC 和 Axis2 是否具有对 XML 注入 的内置支持？
如果没有，我如何添加自定义代码来自行执行转义和模式验证？
编辑：我查看了JAX-RPC生成的代码，看起来代码执行了架构验证 - 所以这是防止XML注入<的一个步骤/代码>。 剩下的问题是——角色转义怎么办？
关于 Axis2 - 我认为它是基于代表模型的实际 bean 上的注释来完成的 - 所以如果没有限制注释 - 它似乎XML注入是可能的 - 但我也更喜欢专家对此的回答。
Do JAX-RPC and Axis2 have built-in support for XML injection?
If not, how can I add custom code to perform escaping and schema validations on my own?
Edit: I looked at the code generated by JAX-RPC, it looks like the code performs schema validations - so that is one step towards protection from XML injection.
The question that remains is - what about character escaping?
About Axis2 - I think it is done based on annotations on the actual beans that represent the model - so if there are no restriction annotations - it seems like XML injection is possible - but I would prefer an expert's answer on that as well.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果这些技术中的任何一种都容易受到 XML 注入的攻击，我会感到惊讶（顺便问一下，您是指 XPath 注入吗？）。它们基于标准 Java API（例如已经存在很长时间的 JAXP）构建，并自动转义任何危险字符
<、&等。这并不意味着您在自己的应用程序中使用这些技术时不必小心不要引入注入漏洞。例如，在 Java 中安全地参数化 XPath 查询似乎仍然很困难。
I would be surprised if either of these technologies were vulnerable to XML injection (do you mean XPath injection by the way?). They are build on standard Java APIs like JAXP which have been around for a long time, and escape any dangerous characters
<,&etc automatically.That doesn't mean you don't have to be careful you don't introduce injection vulnerabilities when using these technologies in your own application. For example, it still seems difficult to parameterized XPath queries safely in Java.