svn commit: r1691461 - in /db/derby/code/trunk/java: engine/org/apache/derby/iapi/types/SqlXmlUtil.java testing/org/apache/derbyTesting/functionTests/tests/lang/XMLXXETest.java

[bp...@apache.org]

Author: bpendleton
Date: Fri Jul 17 00:13:38 2015
New Revision: 1691461

URL: http://svn.apache.org/r1691461
Log:
DERBY-6807: XXE attack possible by using XmlVTI and the XML datatype


I believe that, when a Java Security Manager is in place, the XML Parser
instantiated by SqlXmlUtil obeys the policies defined by that security
manager, and hence is not vulnerable to XXE attacks (in the sense that
the only attacks that will succeed are those which are permitted by the
security policy).

But when a Java Security Manager is not in place, the SqlXmlUtil code
could be more secure.

This change modifies SqlXmlUtil so that it can detect that there is no
active Security Manager, and, if so, it now disables external entity
expansion and enables FEATURE_SECURE_PROCESSING.


Modified:
    db/derby/code/trunk/java/engine/org/apache/derby/iapi/types/SqlXmlUtil.java
    db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/XMLXXETest.java

Modified: db/derby/code/trunk/java/engine/org/apache/derby/iapi/types/SqlXmlUtil.java
URL: http://svn.apache.org/viewvc/db/derby/code/trunk/java/engine/org/apache/derby/iapi/types/SqlXmlUtil.java?rev=1691461&r1=1691460&r2=1691461&view=diff
==============================================================================
--- db/derby/code/trunk/java/engine/org/apache/derby/iapi/types/SqlXmlUtil.java (original)
+++ db/derby/code/trunk/java/engine/org/apache/derby/iapi/types/SqlXmlUtil.java Fri Jul 17 00:13:38 2015
@@ -198,6 +198,13 @@ public class SqlXmlUtil
             dBF.setValidating(false);
             dBF.setNamespaceAware(true);
 
+            if ( System.getSecurityManager() == null )
+            {
+                dBF.setFeature( XMLConstants.FEATURE_SECURE_PROCESSING, true );
+                dBF.setFeature(
+                 "http://xml.org/sax/features/external-general-entities", false );
+            }
+
             // Load document builder that can be used for parsing XML.
             dBuilder = dBF.newDocumentBuilder();
             dBuilder.setErrorHandler(new XMLErrorHandler());

Modified: db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/XMLXXETest.java
URL: http://svn.apache.org/viewvc/db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/XMLXXETest.java?rev=1691461&r1=1691460&r2=1691461&view=diff
==============================================================================
--- db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/XMLXXETest.java (original)
+++ db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/XMLXXETest.java Fri Jul 17 00:13:38 2015
@@ -119,15 +119,10 @@ public final class XMLXXETest extends Ba
 
 	s.execute( stmt );
 
-	// XXX: The next result is wrong. The expected behavior is that the
-	// query should be rejected as a security violation. See DERBY-6807
-	// for more details; when that issue is resolved, this test will need
-	// to be changed.
-
         JDBC.assertSingleValueResultSet(
                 s.executeQuery(
 	            "SELECT XMLSERIALIZE(xml_col AS CLOB) FROM xml_data"),
-	            "<yolo>HelloWorld</yolo>");
+	            "<yolo/>");
 
         password.delete();
     }