Merge pull request #472 from lostsnow/fix/xxe-check-reflect-exception-catch

fixes xxe check reflect exception catch

Author: lostsnow

dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/vulscan/dynamic/xxe/XMLInputFactoryCheck.java

@@ -22,9 +22,10 @@ && getParentObjectHasSuffix(normalizeWrapper, ".DisallowDoctypeDeclInputFactoryW
             }
             return Support.ALLOWED;
         }
-        Method isPropertySupportedMethod = ReflectUtils.getDeclaredMethodFromClass(cls, "isPropertySupported", new Class[]{String.class});
-        Method getPropertyMethod = ReflectUtils.getDeclaredMethodFromClass(cls, "getProperty", new Class[]{String.class});
         try {
+            Method isPropertySupportedMethod = ReflectUtils.getDeclaredMethodFromClass(cls, "isPropertySupported", new Class[]{String.class});
+            Method getPropertyMethod = ReflectUtils.getDeclaredMethodFromClass(cls, "getProperty", new Class[]{String.class});
+
             boolean supportDTD = invokeXMLInputFactoryMethod(isPropertySupportedMethod, getPropertyMethod, obj,
                     " javax.xml.stream.supportDTD".substring(1));
             if (!supportDTD) {

dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/vulscan/dynamic/xxe/XMLStreamReaderCheck.java

@@ -32,11 +32,13 @@ public Support getSupport(Object obj) {
                 return Support.DISALLOWED;
             }
         }
-        Field fPropertyManagerField = ReflectUtils.getDeclaredFieldFromClassByName(obj.getClass(), "fPropertyManager");
-        if (fPropertyManagerField == null) {
-            return Support.ALLOWED;
-        }
+
         try {
+            Field fPropertyManagerField = ReflectUtils.getDeclaredFieldFromClassByName(obj.getClass(), "fPropertyManager");
+            if (fPropertyManagerField == null) {
+                return Support.ALLOWED;
+            }
+
             return getPropertySupport(fPropertyManagerField.get(obj));
         } catch (IllegalAccessException e) {
             DongTaiLog.debug("Failed to access fPropertyManager {}", e);