微信支付XML外部实体注入漏洞XXE,需要在代码中进行相应的设置。官方提供的是dom4j的一些主流解析xml的解决方法,而我的代码是使用的XmlPullParser解析的,不知道该如何设置?
private Map<String, String> doXMLParse(String xml) throws XmlPullParserException, IOException { InputStream inputStream = new ByteArrayInputStream(xml.getBytes()); Map<String, String> map = null; XmlPullParser pullParser = XmlPullParserFactory.newInstance().newPullParser(); pullParser.setInput(inputStream, "UTF-8"); // 为xml设置要解析的xml数据 int eventType = pullParser.getEventType(); while (eventType != XmlPullParser.END_DOCUMENT) { switch (eventType) { case XmlPullParser.START_DOCUMENT: map = new HashMap<String, String>(); break; case XmlPullParser.START_TAG: String key = pullParser.getName(); if (key.equals("xml")) break; String value = pullParser.nextText(); map.put(key, value); break; case XmlPullParser.END_TAG: break; } eventType = pullParser.next(); } return map; }