Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix vulnerability in xml parsers #10

Merged
merged 1 commit into from
Jan 15, 2016
Merged

Fix vulnerability in xml parsers #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion everrest-core/src/main/java/org/everrest/core/impl/provider/DOMSourceEntityProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,8 @@
import java.lang.annotation.Annotation;
import java.lang.reflect.Type;

import static javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING;

/**
* @author <a href="mailto:andrew00x@gmail.com">Andrey Parfonov</a>
* @version $Id: DOMSourceEntityProvider.java 285 2009-10-15 16:21:30Z aparfonov
Expand Down Expand Up @@ -63,6 +65,12 @@ public DOMSource readFrom(Class<DOMSource> type,
InputStream entityStream) throws IOException {
try {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
try {
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature(FEATURE_SECURE_PROCESSING, true);
} catch (Throwable ignored) {}
factory.setNamespaceAware(true);
Document d = factory.newDocumentBuilder().parse(entityStream);
return new DOMSource(d);
Expand Down Expand Up @@ -102,7 +110,9 @@ public void writeTo(DOMSource t,
OutputStream entityStream) throws IOException {
StreamResult out = new StreamResult(entityStream);
try {
TransformerFactory.newInstance().newTransformer().transform(t, out);
TransformerFactory factory = TransformerFactory.newInstance();
factory.setFeature(FEATURE_SECURE_PROCESSING, true); //it's enough there
factory.newTransformer().transform(t, out);
} catch (TransformerConfigurationException e) {
throw new IOException("Can't write to output stream " + e);
} catch (TransformerException e) {
Expand Down
6 changes: 5 additions & 1 deletion everrest-core/src/main/java/org/everrest/core/impl/provider/SAXSourceEntityProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,8 @@
import java.lang.annotation.Annotation;
import java.lang.reflect.Type;

import static javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING;

/**
* @author <a href="mailto:andrew00x@gmail.com">Andrey Parfonov</a>
* @version $Id: SAXSourceEntityProvider.java 285 2009-10-15 16:21:30Z aparfonov
Expand Down Expand Up @@ -80,7 +82,9 @@ public void writeTo(SAXSource t,
OutputStream entityStream) throws IOException {
StreamResult out = new StreamResult(entityStream);
try {
TransformerFactory.newInstance().newTransformer().transform(t, out);
TransformerFactory factory = TransformerFactory.newInstance();
factory.setFeature(FEATURE_SECURE_PROCESSING, true);
factory.newTransformer().transform(t, out);
} catch (TransformerConfigurationException e) {
throw new IOException("Can't write to output stream " + e);
} catch (TransformerException e) {
Expand Down
6 changes: 5 additions & 1 deletion everrest-core/src/main/java/org/everrest/core/impl/provider/StreamSourceEntityProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,8 @@
import java.lang.annotation.Annotation;
import java.lang.reflect.Type;

import static javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING;

/**
* @author andrew00x
*/
Expand Down Expand Up @@ -75,7 +77,9 @@ public void writeTo(StreamSource t,
OutputStream entityStream) throws IOException {
StreamResult out = new StreamResult(entityStream);
try {
TransformerFactory.newInstance().newTransformer().transform(t, out);
TransformerFactory factory = TransformerFactory.newInstance();
factory.setFeature(FEATURE_SECURE_PROCESSING, true);
factory.newTransformer().transform(t, out);
} catch (TransformerException | TransformerFactoryConfigurationError e) {
throw new IOException("Can't write to output stream " + e);
}
Expand Down
3 changes: 3 additions & 0 deletions ...rest-core/src/main/java/org/everrest/core/impl/provider/XSLTTemplatesContextResolver.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,8 @@
import java.util.HashMap;
import java.util.Map;

import static javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING;

/**
* Provide cache for transformation templates.
*
Expand Down Expand Up @@ -86,6 +88,7 @@ public void addAsTemplate(String name, Source source) throws IOException, SAXExc
}
synchronized (templates) {
SAXTransformerFactory factory = (SAXTransformerFactory)SAXTransformerFactory.newInstance();
factory.setFeature(FEATURE_SECURE_PROCESSING, true);
TemplatesHandler templateHandler = factory.newTemplatesHandler();
XMLReader xmlReader = XMLReaderFactory.createXMLReader();
if (resolver != null) {
Expand Down
12 changes: 10 additions & 2 deletions everrest-core/src/main/java/org/everrest/core/tools/ErrorPages.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,8 @@
import java.util.HashMap;
import java.util.Map;

import static javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING;

/**
* Describes error-page references for web application in web.xml file.
*
Expand Down Expand Up @@ -58,8 +60,14 @@ protected void loadErrorPages(ServletContext servletContext, Map<Integer, String
return;
}
try {
DocumentBuilder documentBuilder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
Document dom = documentBuilder.parse(input);
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
try {
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature(FEATURE_SECURE_PROCESSING, true);
} catch (Throwable ignored) {}
Document dom = factory.newDocumentBuilder().parse(input);
XPathFactory xpathFactory = XPathFactory.newInstance();
XPath xpath = xpathFactory.newXPath();
NodeList all = (NodeList)xpath.evaluate("/web-app/error-page", dom, XPathConstants.NODESET);
Expand Down
12 changes: 10 additions & 2 deletions everrest-core/src/main/java/org/everrest/core/tools/WebApplicationDeclaredRoles.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,8 @@
import java.util.LinkedHashSet;
import java.util.Set;

import static javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING;

/**
* Describes roles declared for web application in web.xml file.
*
Expand All @@ -48,8 +50,14 @@ protected Set<String> loadRoles(ServletContext servletContext) throws UnhandledE
return Collections.emptySet();
}
try {
DocumentBuilder documentBuilder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
Document dom = documentBuilder.parse(input);
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
try {
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature(FEATURE_SECURE_PROCESSING, true);
} catch (Throwable ignored) {}
Document dom = factory.newDocumentBuilder().parse(input);
XPathFactory xpathFactory = XPathFactory.newInstance();
XPath xpath = xpathFactory.newXPath();
NodeList all = (NodeList)xpath.evaluate("/web-app/security-role/role-name", dom, XPathConstants.NODESET);
Expand Down