XML Injection for all registrations about azure-notificationhubs-java-backend

[marstr]

Howdy @jvbeck,

You must be looking at code like the following:

azure-notificationhubs-java-backend/NotificationHubs/src/com/windowsazure/messaging/Registration.java

Lines 103 to 115 in f4120c0

	protected String getTagsXml() {
	StringBuffer buf = new StringBuffer();
	if (!tags.isEmpty()) {
	buf.append("<Tags>");
	for (Iterator<String> i = tags.iterator(); i.hasNext();) {
	buf.append(i.next());
	if (i.hasNext())
	buf.append(",");
	}
	buf.append("</Tags>");
	}
	return buf.toString();
	}

Are you experiencing any trouble derived from this, or are you just noting a potential improvement?

[jvbeck]

Hi, I am also referring to code like

https://github.com/Azure/azure-notificationhubs-java-backend/blob/master/NotificationHubs/src/com/windowsazure/messaging/AppleRegistration.java#L69-L78

This sample occurs in every Registration class.

If the NH registration is done by the back-end then the PNS handle must be transferred from the mobile device to the back-end.

I do not know how much mischief could be caused by this XML injection. I merely note that it is possible.

I can easily workaround the problem by overriding the getXml method in "fix" classes that extend the provided Registration classes.

[jvbeck]

Note also my comment on #44

[mpodwysocki]

@jvbeck After review, our backend is not vulnerable to XML Injection attacks but will make a note of this for future versions.