How to disable XInclude when parsing XML?

Question

I have been given to understand that XInclude is a potential vulnerability when receiving XML from untrusted sources. See https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#Java

The XML which I expect from external sources is quite simple and there is never any requirement for including external XML.

I have tried the following to disable XInclude (as recommended in the Cheat Sheet):

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setXIncludeAware(false);
dbf.setExpandEntityReferences(false);

and used this XML to test

<?xml version="1.0" encoding="utf-8"?>
<data xmlns:xi="http://www.w3.org/2001/XInclude">
    <xi:include href="file://d/temp/badxml.xml" parse="xml">
    </xi:include>
</data>

The external file contains invalid XML.

I had expected that the parser would fail if setXIncludeAware is set to true but this is not the case. The snippet is always parseable. I am using Java 8.

Is this a valid test? Is this the correct way to avoid XInclude attacks?

Answer 1

This is the correct way to avoid XInclude and entity attacks, but that is not a valid test for XInclude attacks, as you have discovered.

According to this answer , "XInclude support relies on namespace support, which is turned off by default for backward compatibility reasons". So call dbf.setNamespaceAware(true);