title: Prevent XXE Attack with JAXB
body: <p>Recently, we had a security audit on our code, and one of the problem is that our application is subject to the <strong>Xml eXternal Entity</strong> (XXE) attack.</p>
  
  <p>Basically, the application is a calculator that receives inputs as XML, through a Web-Service.</p>
  
  <p>Here is an example of such an XXE attack on our application:</p>
  
  <pre><code>&lt;soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"&gt;
     &lt;soapenv:Header/&gt;
     &lt;soapenv:Body&gt;
        &lt;foo:calculateStuff&gt;
           &lt;!--Optional:--&gt;
           &lt;xmlInput&gt;&lt;![CDATA[&lt;?xml version="1.0" encoding="UTF-8" standalone="yes"?&gt;
  &lt;!DOCTYPE currency [  
     &lt;!ENTITY include SYSTEM "file:///d:/" &gt;]&gt;
  &lt;calcinput&gt;...&lt;/calcinput&gt;
  ]]&gt;&lt;/xmlInput&gt;
        &lt;/foo:calculateStuff&gt;
     &lt;/soapenv:Body&gt;
  &lt;/soapenv:Envelope&gt;
  </code></pre>
  
  <p>As you can see, we can refer to an entity that points to an external file (<code>"file:///d:/"</code>).</p>
  
  <p>Regarding the XML input itself (the <code>&lt;calcinput&gt;...&lt;/calcinput&gt;</code> part) is unmarshalled with JAXB (v2.1). The web-service part is based on jaxws-rt (2.1).</p>
  
  <p>What do I need to do to secure my web-service?</p>