You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@creadur.apache.org by po...@apache.org on 2026/07/02 10:47:26 UTC
(creadur-rat) branch fix/XXEwarningInReporter created (now d3a0d69d)
This is an automated email from the ASF dual-hosted git repository.
ottlinger pushed a change to branch fix/XXEwarningInReporter
in repository https://gitbox.apache.org/repos/asf/creadur-rat.git
at d3a0d69d RAT-560, RAT-558: Fix XXE warning while processing provided stylesheets via StandardXmlFactory
This branch includes the following new commits:
new d3a0d69d RAT-560, RAT-558: Fix XXE warning while processing provided stylesheets via StandardXmlFactory
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(creadur-rat) 01/01: RAT-560, RAT-558: Fix XXE warning while processing provided stylesheets via StandardXmlFactory
Posted by po...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
ottlinger pushed a commit to branch fix/XXEwarningInReporter
in repository https://gitbox.apache.org/repos/asf/creadur-rat.git
commit d3a0d69dc5d4af95f6490af6c2ad1bdaf879c59d
Author: P. Ottlinger <po...@apache.org>
AuthorDate: Thu Jul 2 12:47:16 2026 +0200
RAT-560, RAT-558: Fix XXE warning while processing provided stylesheets via StandardXmlFactory
---
apache-rat-core/src/main/java/org/apache/rat/Reporter.java | 12 +-----------
.../java/org/apache/rat/report/xml/writer/XmlWriter.java | 2 +-
.../main/java/org/apache/rat/utils/StandardXmlFactory.java | 8 ++++----
.../java/org/apache/rat/utils/StandardXmlFactoryTests.java | 4 ++--
.../src/main/java/org/apache/rat/tools/xsd/XsdGenerator.java | 2 +-
5 files changed, 9 insertions(+), 19 deletions(-)
diff --git a/apache-rat-core/src/main/java/org/apache/rat/Reporter.java b/apache-rat-core/src/main/java/org/apache/rat/Reporter.java
index 6ca704ca..aa24ad47 100644
--- a/apache-rat-core/src/main/java/org/apache/rat/Reporter.java
+++ b/apache-rat-core/src/main/java/org/apache/rat/Reporter.java
@@ -28,13 +28,10 @@ import java.io.PrintWriter;
import java.io.Writer;
import java.nio.charset.StandardCharsets;
-import javax.xml.transform.OutputKeys;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactory;
import javax.xml.transform.dom.DOMSource;
import javax.xml.transform.stream.StreamResult;
-import javax.xml.transform.stream.StreamSource;
import org.apache.commons.io.function.IOSupplier;
import org.apache.rat.api.RatException;
@@ -136,16 +133,9 @@ public class Reporter {
*/
public ClaimStatistic output(final IOSupplier<InputStream> stylesheet, final IOSupplier<OutputStream> output) throws RatException {
ClaimStatistic result = execute();
- TransformerFactory tf = TransformerFactory.newInstance();
- Transformer transformer;
try (OutputStream out = output.get();
InputStream styleIn = stylesheet.get()) {
- transformer = tf.newTransformer(new StreamSource(styleIn));
- transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes");
- transformer.setOutputProperty(OutputKeys.METHOD, "xml");
- transformer.setOutputProperty(OutputKeys.INDENT, "yes");
- transformer.setOutputProperty(OutputKeys.ENCODING, "UTF-8");
- transformer.setOutputProperty("{http://xml.apache.org/xslt}indent-amount", "4");
+ Transformer transformer = StandardXmlFactory.createTransformer(styleIn);
transformer.transform(new DOMSource(document),
new StreamResult(new OutputStreamWriter(out, StandardCharsets.UTF_8)));
return result;
diff --git a/apache-rat-core/src/main/java/org/apache/rat/report/xml/writer/XmlWriter.java b/apache-rat-core/src/main/java/org/apache/rat/report/xml/writer/XmlWriter.java
index c9c0c16d..40440845 100644
--- a/apache-rat-core/src/main/java/org/apache/rat/report/xml/writer/XmlWriter.java
+++ b/apache-rat-core/src/main/java/org/apache/rat/report/xml/writer/XmlWriter.java
@@ -356,7 +356,7 @@ public final class XmlWriter implements AutoCloseable {
appendable.append(System.lineSeparator());
currentAttributes.clear();
try {
- Transformer transformer = StandardXmlFactory.create();
+ Transformer transformer = StandardXmlFactory.createTransformer();
ByteArrayOutputStream baos = new ByteArrayOutputStream();
transformer.transform(new DOMSource(document),
new StreamResult(baos));
diff --git a/apache-rat-core/src/main/java/org/apache/rat/utils/StandardXmlFactory.java b/apache-rat-core/src/main/java/org/apache/rat/utils/StandardXmlFactory.java
index 38f4cd08..3ec9849a 100644
--- a/apache-rat-core/src/main/java/org/apache/rat/utils/StandardXmlFactory.java
+++ b/apache-rat-core/src/main/java/org/apache/rat/utils/StandardXmlFactory.java
@@ -52,8 +52,8 @@ public final class StandardXmlFactory {
* @return the transformer.
* @throws TransformerConfigurationException on error.
*/
- public static Transformer create() throws TransformerConfigurationException {
- return create(null);
+ public static Transformer createTransformer() throws TransformerConfigurationException {
+ return createTransformer(null);
}
/**
@@ -62,8 +62,8 @@ public final class StandardXmlFactory {
* @return the transformer.
* @throws TransformerConfigurationException on error.
*/
- public static Transformer create(final InputStream styleIn) throws TransformerConfigurationException {
- TransformerFactory factory = TransformerFactory.newInstance();
+ public static Transformer createTransformer(final InputStream styleIn) throws TransformerConfigurationException {
+ TransformerFactory factory = TransformerFactory.newInstance(); // NOSONAR
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
diff --git a/apache-rat-core/src/test/java/org/apache/rat/utils/StandardXmlFactoryTests.java b/apache-rat-core/src/test/java/org/apache/rat/utils/StandardXmlFactoryTests.java
index e33c10d8..bfffac4f 100644
--- a/apache-rat-core/src/test/java/org/apache/rat/utils/StandardXmlFactoryTests.java
+++ b/apache-rat-core/src/test/java/org/apache/rat/utils/StandardXmlFactoryTests.java
@@ -37,12 +37,12 @@ class StandardXmlFactoryTests {
@Test
void noArg() throws TransformerConfigurationException {
- assertThat(StandardXmlFactory.create()).isNotNull();
+ assertThat(StandardXmlFactory.createTransformer()).isNotNull();
}
@Test
void noEmptyInput() {
- assertThatThrownBy(() -> StandardXmlFactory.create(InputStream.nullInputStream()))
+ assertThatThrownBy(() -> StandardXmlFactory.createTransformer(InputStream.nullInputStream()))
.isInstanceOf(TransformerConfigurationException.class);
}
diff --git a/apache-rat-tools/src/main/java/org/apache/rat/tools/xsd/XsdGenerator.java b/apache-rat-tools/src/main/java/org/apache/rat/tools/xsd/XsdGenerator.java
index a3ceb01c..7f126190 100644
--- a/apache-rat-tools/src/main/java/org/apache/rat/tools/xsd/XsdGenerator.java
+++ b/apache-rat-tools/src/main/java/org/apache/rat/tools/xsd/XsdGenerator.java
@@ -72,7 +72,7 @@ public class XsdGenerator {
try (InputStream in = generator.getInputStream();
InputStream styleIn = StyleSheets.XML.getStyleSheet().get()) {
- Transformer transformer = StandardXmlFactory.create(styleIn);
+ Transformer transformer = StandardXmlFactory.createTransformer(styleIn);
transformer.transform(new StreamSource(in),
new StreamResult(new OutputStreamWriter(System.out, StandardCharsets.UTF_8)));
}