Skip to content

Feature xml xxe prevention #512

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sahvx655-wq wants to merge 1 commit into
base: master
Choose a base branch
from
+111 −0
Open

Feature xml xxe prevention #512

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions bundlerepository/src/main/java/org/apache/felix/bundlerepository/impl/StaxParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,8 @@ public static synchronized XMLInputFactory getFactory()
setProperty(factory, XMLInputFactory.IS_NAMESPACE_AWARE, false);
setProperty(factory, XMLInputFactory.IS_VALIDATING, false);
setProperty(factory, XMLInputFactory.IS_COALESCING, false);
setProperty(factory, XMLInputFactory.SUPPORT_DTD, false);
setProperty(factory, XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
StaxParser.factory = factory;
}
return factory;
Expand Down
8 changes: 8 additions & 0 deletions ...tor/src/main/java/org/apache/felix/ipojo/manipulator/metadata/StreamMetadataProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,14 @@ public List<Element> getMetadatas() throws IOException {
XMLMetadataParser handler = new XMLMetadataParser();

XMLReader parser = XMLReaderFactory.createXMLReader();
try {
parser.setFeature("http://xml.org/sax/features/external-general-entities", false);
parser.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
parser.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
parser.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
} catch (Exception e) {
// Ignore
}
parser.setContentHandler(handler);
parser.setFeature("http://xml.org/sax/features/validation", true);
parser.setFeature("http://apache.org/xml/features/validation/schema", true);
Expand Down
6 changes: 6 additions & 0 deletions ...a/org/apache/felix/ipojo/manipulator/metadata/annotation/module/DefaultBindingModule.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -273,6 +273,12 @@ protected DocumentBuilder getFreshDocumentBuilder(Reporter reporter) {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setNamespaceAware(true);
try {
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature(javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setXIncludeAware(false);
m_builder = factory.newDocumentBuilder();
} catch (ParserConfigurationException e) {
// TODO GSA is this acceptable to throw a RuntimeException here ?
Expand Down
10 changes: 10 additions & 0 deletions ...elix/ipojo/manipulator/metadata/annotation/visitor/HandlerDeclarationVisitorTestCase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,16 @@ public void testAttributeConversionWithNoNamespace() throws Exception {
private DocumentBuilder builder() throws ParserConfigurationException {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setNamespaceAware(true);
try {
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature(javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setXIncludeAware(false);
} catch (Exception e) {
// Ignore
}
return factory.newDocumentBuilder();
}
}
12 changes: 12 additions & 0 deletions scr/src/main/java/org/apache/felix/scr/impl/BundleComponentActivator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -427,6 +427,18 @@ private void loadDescriptor(final URL descriptorURL)
getConfiguration().keepInstances(), m_trueCondition);
final SAXParserFactory factory = SAXParserFactory.newInstance();
factory.setNamespaceAware(true);
try
{
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setXIncludeAware(false);
}
catch (Exception e)
{
logger.log(Level.WARN, "Failed to configure SAXParserFactory to prevent XXE", e);
}
final SAXParser parser = factory.newSAXParser();

parser.parse( stream, handler );
Expand Down
12 changes: 12 additions & 0 deletions scr/src/test/java/org/apache/felix/scr/impl/metadata/ComponentBase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,18 @@ private List<ComponentMetadata> readMetadata(InputStream in)
{
final SAXParserFactory factory = SAXParserFactory.newInstance();
factory.setNamespaceAware(true);
try
{
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setXIncludeAware(false);
}
catch (Exception e)
{
// Ignore
}
final SAXParser parser = factory.newSAXParser();

XmlHandler handler = new XmlHandler(new MockBundle(), logger, false, false, null);
Expand Down
41 changes: 41 additions & 0 deletions scr/src/test/java/org/apache/felix/scr/impl/xml/XmlHandlerTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,38 @@ public void testSatisfyingConditionSpecified() throws Exception
trueDependency.getTarget());
}

@Test(expected = Exception.class)
public void testParserRejectsXXE() throws Exception {
String xml = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" +
"<!DOCTYPE scr:component [\n" +
" <!ENTITY xxe SYSTEM \"http://127.0.0.1:9999/test\">\n" +
"]>\n" +
"<scr:component xmlns:scr=\"http://www.osgi.org/xmlns/scr/v1.0.0\" name=\"test\">\n" +
" <property name=\"val\" value=\"&xxe;\"/>\n" +
" <implementation class=\"test.MyComponent\"/>\n" +
"</scr:component>";
final Bundle bundle = Mockito.mock(Bundle.class);
Mockito.when(bundle.getLocation()).thenReturn("bundle");

try (java.io.ByteArrayInputStream stream = new java.io.ByteArrayInputStream(xml.getBytes("UTF-8"))) {
XmlHandler handler = new XmlHandler(bundle, new MockBundleLogger(), false,
false, null);
final SAXParserFactory factory = SAXParserFactory.newInstance();
factory.setNamespaceAware(true);
try {
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setXIncludeAware(false);
} catch (Exception e) {
// Ignore
}
final SAXParser parser = factory.newSAXParser();
parser.parse(stream, handler);
}
}

private List<ComponentMetadata> parse(final URL descriptorURL,
ServiceReference<?> trueCondition) throws Exception
{
Expand All @@ -125,6 +157,15 @@ private List<ComponentMetadata> parse(final URL descriptorURL,
false, trueCondition);
final SAXParserFactory factory = SAXParserFactory.newInstance();
factory.setNamespaceAware(true);
try {
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setXIncludeAware(false);
} catch (Exception e) {
// Ignore
}
final SAXParser parser = factory.newSAXParser();

parser.parse(stream, handler);
Expand Down
9 changes: 9 additions & 0 deletions ...eck-maven-plugin/src/main/java/org/apache/felix/maven/osgicheck/impl/checks/SCRCheck.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -340,6 +340,15 @@ public ComponentLogger component(Bundle m_bundle, String implementationClassName
try {
final SAXParserFactory factory = SAXParserFactory.newInstance();
factory.setNamespaceAware(true);
try {
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setXIncludeAware(false);
} catch (final Exception e) {
// Ignore or log
}
final SAXParser parser = factory.newSAXParser();
parser.parse(file, handler);

Expand Down
9 changes: 9 additions & 0 deletions ...in/java/org/apache/felix/maven/osgicheck/impl/mddocgen/ServicesMarkdownGeneratorMojo.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,6 +147,15 @@ private List<ComponentMetadata> readComponentMetadata(File serviceFile) {
XmlHandler xmlHandler = new XmlHandler(new SyntheticBundle(servicesDirectory, serviceFile), mavenScrLogger, false, true, null);
final SAXParserFactory factory = SAXParserFactory.newInstance();
factory.setNamespaceAware(true);
try {
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setXIncludeAware(false);
} catch (Exception e) {
// Ignore or log
}
final SAXParser parser = factory.newSAXParser();
parser.parse(serviceFile, xmlHandler);

Expand Down
2 changes: 2 additions & 0 deletions utils/src/main/java/org/apache/felix/utils/repository/StaxParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -436,6 +436,8 @@ private static synchronized XMLInputFactory getInputFactory() {
if (StaxParser.inputFactory == null) {
XMLInputFactory factory = XMLInputFactory.newInstance();
factory.setProperty(XMLInputFactory.IS_NAMESPACE_AWARE, true);
factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
StaxParser.inputFactory = factory;
}
return StaxParser.inputFactory;
Expand Down
Loading