I am trying to work on the XXE Loophole recently found for wechat. There are codes given in the link provided by the clients to check whether the website is effected by this bug.

Here is that link.

My client said that other projects tried to use the Java code given in this link for Inspection and repair of this bug.

I have tried to convert the given Java code to Demandware script. Here is what I tried:

importPackage (dw.util);

function execute( args : PipelineDictionary ) : Number
    var doc : XML = new XML();
    var FEATURE : String = "";
    var Obj : Object = [];
        FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";
        return PIPELET_NEXT;
    }catch (e) {
        // This should catch a failed setFeature feature
        logger.info("ParserConfigurationException was thrown. The feature '" +
        FEATURE + "' is probably not supported by your XML processor.");
        return PIPELET_ERROR;

I have a guess that, the function that I used instead of the function setFeature(String, boolean) is wrong. But I am new to this type of 3rd party issues. I have the following questions:

  1. What is the alternative of the function setFeature(String, boolean) in demandware script?
  2. If the script that I wrote by converting the Java code is wrong, then how should I do this?


I have analysed the situation and got to the conclusion that the payment through Wechat has not issues but there is an issue while parsing XML objects. In the case of payment through wechat, we have to send a response to the Wechat, and then they process it (3rd party).

When we are sending the XML data to them in the form of response, the attacker can hack the information by using XML injection. So is there any way by which we can prevent XML injection?

I have a few algorithms in my mind but all of them have to process the response again when received. So is there any other way to do that using Demandware Script?

Really stuck on it and the deadline is near. Please help if anyone have the solution. Thanks in advance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.