VNX-610: Externally Controlled Reference to a Resource in Another Sphere (XML external references enabled)

Reports Java XML parser calls that explicitly enable external references: external entities or DTDs on, disallow-doctype-decl or secure processing off, ACCESS_EXTERNAL_* opened, or XInclude on.

Field	Value
Rule ID	`VNX-610`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	Java
CWE	CWE-610
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`external-entity` `xml` `cwe-610`
Source	`internal/sast/rules/vnx-610.rego`

Overview

VNX-610 maps to CWE-610: Externally Controlled Reference to a Resource in Another Sphere. CWE-610 is a class; this rule reports its most concrete Java form, a call that explicitly turns external references on:

setFeature(".../external-general-entities" | ".../external-parameter-entities" | ".../load-external-dtd", true)
setFeature(".../disallow-doctype-decl", false) and setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, false)
setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, true)
setAttribute/setProperty(ACCESS_EXTERNAL_DTD | ACCESS_EXTERNAL_SCHEMA | ACCESS_EXTERNAL_STYLESHEET, "all") or a protocol list such as "file,http"
setXIncludeAware(true)

Calls whose arguments continue on the next lines are read. Not reported: the same calls switching the feature off, unrelated features, and factories left at defaults (VNX-JAVA-004 and VNX-JAVA-029 judge unhardened factories).

Why This Matters

A document parsed with these settings can make the parser read local files (file:///etc/passwd), call internal URLs, or include other documents, and return what it read in the parsed result.

What Gets Flagged

reader.setFeature("http://xml.org/sax/features/external-general-entities", true);
xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, true);
tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "all");
f.setXIncludeAware(true);
parser.getXMLReader().setFeature(
        "http://xml.org/sax/features/external-parameter-entities", true);
spf.setFeature(GENERAL_ENTITIES, true);   // constant holding the feature URL
System.setProperty("javax.xml.accessExternalDTD", "all");

Remediation

Remove the call, or set the feature to its safe value: disallow-doctype-decl true, external entities false, ACCESS_EXTERNAL_* to "".
If a document needs an external DTD or schema, resolve it from a local catalogue with an EntityResolver.
For a confirmed false positive, add a // vulnetix-ignore: VNX-610 comment on the line.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-610
// nosec vnx-610

Or record an ignore rule: vulnetix ignore add --rule vnx-610 --reason "...". See Suppressing findings.