diff options
author | Gary D. Gregory <ggregory@apache.org> | 2014-03-24 20:55:14 +0000 |
---|---|---|
committer | Dave Daynard <nardholio@gmail.com> | 2014-10-19 16:42:27 -0400 |
commit | 4df2280acaca0bcf7b25004a540291627787b387 (patch) | |
tree | c3f2e17ca7b1f8882257983a1ca7ae6c9eb6471e | |
parent | 00ee83ff1bd827a852065986ed0da7a3ded57a55 (diff) | |
download | apache-xml-4df2280acaca0bcf7b25004a540291627787b387.tar.gz |
Commit patch to handle secure processing. Thank you Ryan Berg.
git-svn-id: https://svn.apache.org/repos/asf/xalan/java/branches/xalan-j_2_7_1_maint@1581058 13f79535-47bb-0310-9956-ffa450edef68
4 files changed, 62 insertions, 28 deletions
diff --git a/src/main/java/org/apache/xalan/processor/TransformerFactoryImpl.java b/src/main/java/org/apache/xalan/processor/TransformerFactoryImpl.java index 618b412..3e29acc 100644 --- a/src/main/java/org/apache/xalan/processor/TransformerFactoryImpl.java +++ b/src/main/java/org/apache/xalan/processor/TransformerFactoryImpl.java @@ -335,6 +335,10 @@ public class TransformerFactoryImpl extends SAXTransformerFactory reader = XMLReaderFactory.createXMLReader(); } + if(m_isSecureProcessing) + { + reader.setFeature("http://xml.org/sax/features/external-general-entities",false); + } // Need to set options! reader.setContentHandler(handler); reader.parse(isource); diff --git a/src/main/java/org/apache/xalan/processor/XSLTElementProcessor.java b/src/main/java/org/apache/xalan/processor/XSLTElementProcessor.java index 7858b42..fc4b2e3 100644 --- a/src/main/java/org/apache/xalan/processor/XSLTElementProcessor.java +++ b/src/main/java/org/apache/xalan/processor/XSLTElementProcessor.java @@ -338,17 +338,31 @@ public class XSLTElementProcessor extends ElemTemplateElement } else { - // Can we switch the order here: - - boolean success = attrDef.setAttrValue(handler, attrUri, attrLocalName, - attributes.getQName(i), attributes.getValue(i), - target); - - // Now we only add the element if it passed a validation check - if (success) - processedDefs.add(attrDef); + //handle secure processing + if(handler.getStylesheetProcessor()==null) + System.out.println("stylesheet processor null"); + if(attrDef.getName().compareTo("*")==0 && handler.getStylesheetProcessor().isSecureProcessing()) + { + //foreign attributes are not allowed in secure processing mode + // Then barf, because this element does not allow this attribute. + handler.error(XSLTErrorResources.ER_ATTR_NOT_ALLOWED, new Object[]{attributes.getQName(i), rawName}, null);//"\""+attributes.getQName(i)+"\"" + //+ " attribute is not allowed on the " + rawName + // + " element!", null); + } else - errorDefs.add(attrDef); + { + + + boolean success = attrDef.setAttrValue(handler, attrUri, attrLocalName, + attributes.getQName(i), attributes.getValue(i), + target); + + // Now we only add the element if it passed a validation check + if (success) + processedDefs.add(attrDef); + else + errorDefs.add(attrDef); + } } } diff --git a/src/main/java/org/apache/xalan/transformer/TransformerImpl.java b/src/main/java/org/apache/xalan/transformer/TransformerImpl.java index cf550b9..35e5ea9 100644 --- a/src/main/java/org/apache/xalan/transformer/TransformerImpl.java +++ b/src/main/java/org/apache/xalan/transformer/TransformerImpl.java @@ -382,7 +382,9 @@ public class TransformerImpl extends Transformer try { if (sroot.getExtensions() != null) - m_extensionsTable = new ExtensionsTable(sroot); + //only load extensions if secureProcessing is disabled + if(!sroot.isSecureProcessing()) + m_extensionsTable = new ExtensionsTable(sroot); } catch (javax.xml.transform.TransformerException te) {te.printStackTrace();} diff --git a/src/main/java/org/apache/xpath/functions/FuncSystemProperty.java b/src/main/java/org/apache/xpath/functions/FuncSystemProperty.java index 154e686..2621d7a 100644 --- a/src/main/java/org/apache/xpath/functions/FuncSystemProperty.java +++ b/src/main/java/org/apache/xpath/functions/FuncSystemProperty.java @@ -58,7 +58,7 @@ public class FuncSystemProperty extends FunctionOneArg String fullName = m_arg0.execute(xctxt).str(); int indexOfNSSep = fullName.indexOf(':'); - String result; + String result = null; String propName = ""; // List of properties where the name of the @@ -98,14 +98,21 @@ public class FuncSystemProperty extends FunctionOneArg try { - result = System.getProperty(propName); - - if (null == result) - { - - // result = System.getenv(propName); - return XString.EMPTYSTRING; - } + //if secure procession is enabled only handle required properties do not not map any valid system property + if(!xctxt.isSecureProcessing()) + { + result = System.getProperty(fullName); + } + else + { + warn(xctxt, XPATHErrorResources.WG_SECURITY_EXCEPTION, + new Object[]{ fullName }); //"SecurityException when trying to access XSL system property: "+fullName); + result = xsltInfo.getProperty(propName); + } + if (null == result) + { + return XString.EMPTYSTRING; + } } catch (SecurityException se) { @@ -120,14 +127,21 @@ public class FuncSystemProperty extends FunctionOneArg { try { - result = System.getProperty(fullName); - - if (null == result) - { - - // result = System.getenv(fullName); - return XString.EMPTYSTRING; - } + //if secure procession is enabled only handle required properties do not not map any valid system property + if(!xctxt.isSecureProcessing()) + { + result = System.getProperty(fullName); + } + else + { + warn(xctxt, XPATHErrorResources.WG_SECURITY_EXCEPTION, + new Object[]{ fullName }); //"SecurityException when trying to access XSL system property: "+fullName); + result = xsltInfo.getProperty(propName); + } + if (null == result) + { + return XString.EMPTYSTRING; + } } catch (SecurityException se) { |