解决微信支付XXE漏洞

iamberry-common-tool/src/main/java/com/iamberry/wechat/tools/GetWxOrderno.java

@@ -23,25 +23,14 @@ public class GetWxOrderno {
    */
   public static Object getPayNo(String url,String xmlParam){
 	try {
-		
-
-System.out.println("getPayNo start....");
-		
 		String jsonStr = HttpClient431Util.doPostContent(xmlParam, "application/json", url);
 		//判断
-	    if(jsonStr.indexOf("FAIL")!=-1){
-	    	WxPrepayIdErrorResult errorResult = (WxPrepayIdErrorResult) MessageUtil.xmlToBean(jsonStr, WxPrepayIdErrorResult.class);
-	    	
-System.out.println("getPayNo errorResult...." + jsonStr);
-	    	
-	    	return errorResult;
+		assert jsonStr != null;
+		if(jsonStr.contains("FAIL")){
+			return (WxPrepayIdErrorResult) MessageUtil.xmlToBean(jsonStr, WxPrepayIdErrorResult.class);
 	    }
 	    Map map = doXMLParse(jsonStr);
-	    String prepay_id  = (String) map.get("prepay_id");
-
-System.out.println("getPayNo end....");
-	    
-	    return prepay_id;
+		return (String) map.get("prepay_id");
 	} catch (Exception e1) {
 		// TODO Auto-generated catch block
 		e1.printStackTrace();
@@ -136,6 +125,14 @@ System.out.println("getPayNo end....");
 		Map m = new HashMap();
 		InputStream in = String2Inputstream(strxml);
 		SAXBuilder builder = new SAXBuilder();
+
+
+		// 防止XXE
+		builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+		builder.setFeature("http://xml.org/sax/features/external-general-entities", false);
+		builder.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+		builder.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+
 		Document doc = builder.build(in);
 		Element root = doc.getRootElement();
 		List list = root.getChildren();

iamberry-wechat-web/src/main/java/com/iamberry/wechat/handles/pay/ResponseWechatPayHandler.java

@@ -287,6 +287,13 @@ public class ResponseWechatPayHandler {
 			InputSource source = new InputSource(read);
 			// 创建一个新的SAXBuilder
 			SAXBuilder sb = new SAXBuilder();
+
+			// 防止XXE
+			sb.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+			sb.setFeature("http://xml.org/sax/features/external-general-entities", false);
+			sb.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+			sb.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+
 			// 通过输入源构造一个Document
 			Document doc = (Document) sb.build(source);
 			Element root = doc.getRootElement();// 指向根节点

watero-wechat-web/src/main/java/com/iamberry/wechat/handles/pay/ResponseWechatPayHandler.java

@@ -14,6 +14,7 @@ import java.util.UUID;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import javax.xml.parsers.DocumentBuilderFactory;
 
 import com.iamberry.wechat.core.entity.rent.ReserveOrder;
 import com.iamberry.wechat.face.reserve.ReserveService;
@@ -282,6 +283,13 @@ public class ResponseWechatPayHandler {
 			InputSource source = new InputSource(read);
 			// 创建一个新的SAXBuilder
 			SAXBuilder sb = new SAXBuilder();
+			// 防止XXE
+			sb.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+			sb.setFeature("http://xml.org/sax/features/external-general-entities", false);
+			sb.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+			sb.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+
+
 			// 通过输入源构造一个Document
 			Document doc = (Document) sb.build(source);
 			Element root = doc.getRootElement();// 指向根节点