You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by ja...@apache.org on 2026/04/27 18:35:59 UTC
(ofbiz-framework) branch release24.09 updated (a9a3237fe9 -> 86c6f3a4f4)
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a change to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
from a9a3237fe9 Improved: Update allowed local file paths to enhance security
new eb6c54aba6 Reverted: commit 6e8d8620ac
new 23bac92261 Fixed: Enhance XML processing security by disabling external entity resolution across multiple classes
new 86c6f3a4f4 Fixed: Wrap setAttribute(ACCESS_EXTERNAL_DTD, ...) calls to catch IllegalArgumentException thrown by older versions of Xalan/Saxon that predate JAXP 1.5
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../thirdparty/eway/GatewayResponse.java | 4 +--
.../java/org/apache/ofbiz/base/util/UtilHtml.java | 2 ++
.../java/org/apache/ofbiz/base/util/UtilXml.java | 21 ++++++++++++-
.../ofbiz/base/util/string/UelFunctions.java | 10 +++++++
.../ofbiz/base/util/template/XslTransform.java | 12 ++++++--
.../ofbiz/entity/serialize/XmlSerializer.java | 34 +++++++++++++++++-----
.../apache/ofbiz/entity/util/EntitySaxReader.java | 9 +++++-
.../org/apache/ofbiz/minilang/MiniLangUtil.java | 8 +++++
.../org/apache/ofbiz/security/SecuredUpload.java | 4 +++
.../org/apache/ofbiz/service/ModelService.java | 2 ++
.../ofbiz/service/engine/SOAPClientEngine.java | 5 +++-
.../ofbiz/webapp/event/SOAPEventHandler.java | 10 +++++--
.../apache/ofbiz/webapp/view/ApacheFopWorker.java | 8 +++++
.../apache/ofbiz/webtools/WebToolsServices.java | 2 ++
14 files changed, 114 insertions(+), 17 deletions(-)
(ofbiz-framework) 01/03: Reverted: commit 6e8d8620ac
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit eb6c54aba6810c5f9c905c21f068ec4b8c71b764
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Thu Apr 23 18:36:52 2026 +0200
Reverted: commit 6e8d8620ac
The commit 6e8d8620ac, "Fixed: Remove support for serialization and deserialization of custom Java objects in XmlSerializer for security reasons", implemented a defense-in-depth against deserialization attacks by disabling suport for custom objects. While deserializing custom objects, without proper checks, is not recommended, and we should consider to abandon this feature, this commit re-adds it, because of some regressions (e.g. errors scheduling email notifications for sales orders).
(cherry picked from commit 20f8f532aabf8a2139d7270036f7f3062f6beec0)
---
.../ofbiz/entity/serialize/XmlSerializer.java | 34 +++++++++++++++++-----
1 file changed, 26 insertions(+), 8 deletions(-)
diff --git a/framework/entity/src/main/java/org/apache/ofbiz/entity/serialize/XmlSerializer.java b/framework/entity/src/main/java/org/apache/ofbiz/entity/serialize/XmlSerializer.java
index deaeb38012..ce954005a7 100644
--- a/framework/entity/src/main/java/org/apache/ofbiz/entity/serialize/XmlSerializer.java
+++ b/framework/entity/src/main/java/org/apache/ofbiz/entity/serialize/XmlSerializer.java
@@ -20,6 +20,7 @@ package org.apache.ofbiz.entity.serialize;
import java.io.FileNotFoundException;
import java.io.IOException;
+import java.io.Serializable;
import java.lang.ref.WeakReference;
import java.math.BigDecimal;
import java.math.RoundingMode;
@@ -47,8 +48,10 @@ import javax.xml.bind.DatatypeConverter;
import javax.xml.parsers.ParserConfigurationException;
import org.apache.ofbiz.base.util.Debug;
+import org.apache.ofbiz.base.util.StringUtil;
import org.apache.ofbiz.base.util.UtilGenerics;
import org.apache.ofbiz.base.util.UtilMisc;
+import org.apache.ofbiz.base.util.UtilObject;
import org.apache.ofbiz.base.util.UtilXml;
import org.apache.ofbiz.entity.Delegator;
import org.apache.ofbiz.entity.GenericPK;
@@ -254,11 +257,18 @@ public class XmlSerializer {
}
public static Element serializeCustom(Object object, Document document) throws SerializeException {
- Debug.logError("Serialization of custom Java objects (cus-obj) is no longer supported. "
- + "This feature has been removed for security reasons. Object class: "
- + object.getClass().getName(), MODULE);
- throw new SerializeException("Serialization of custom Java objects is not supported. "
- + "Object class: " + object.getClass().getName());
+ if (object instanceof Serializable) {
+ byte[] objBytes = UtilObject.getBytes(object);
+ if (objBytes == null) {
+ throw new SerializeException("Unable to serialize object; null byte array returned");
+ }
+ String byteHex = StringUtil.toHexString(objBytes);
+ Element element = document.createElement("cus-obj");
+ // this is hex encoded so does not need to be in a CDATA block
+ element.appendChild(document.createTextNode(byteHex));
+ return element;
+ }
+ throw new SerializeException("Cannot serialize object of class " + object.getClass().getName());
}
public static Element makeElement(String elementName, Object value, Document document) {
@@ -455,9 +465,17 @@ public class XmlSerializer {
public static Object deserializeCustom(Element element) throws SerializeException {
String tagName = element.getLocalName();
if ("cus-obj".equals(tagName)) {
- Debug.logError("Deserialization of cus-obj elements is no longer supported. "
- + "This feature has been removed for security reasons.", MODULE);
- throw new SerializeException("Deserialization of cus-obj elements is not supported.");
+ String value = UtilXml.elementValue(element);
+ if (value != null) {
+ byte[] valueBytes = StringUtil.fromHexString(value);
+ if (valueBytes != null) {
+ Object obj = UtilObject.getObject(valueBytes);
+ if (obj != null) {
+ return obj;
+ }
+ }
+ }
+ throw new SerializeException("Problem deserializing object from byte array + " + element.getLocalName());
}
throw new SerializeException("Cannot deserialize element named " + element.getLocalName());
}
(ofbiz-framework) 02/03: Fixed: Enhance XML processing security by disabling external entity resolution across multiple classes
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 23bac922618e647ed3d427d8793e981640475411
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Mon Apr 27 16:23:01 2026 +0200
Fixed: Enhance XML processing security by disabling external entity resolution across multiple classes
(cherry picked from commit 618de331c19686fb2ea3edcf1db0417a4b1721fc)
---
.../ofbiz/accounting/thirdparty/eway/GatewayResponse.java | 4 ++--
.../src/main/java/org/apache/ofbiz/base/util/UtilHtml.java | 2 ++
.../src/main/java/org/apache/ofbiz/base/util/UtilXml.java | 13 ++++++++++++-
.../org/apache/ofbiz/base/util/string/UelFunctions.java | 6 ++++++
.../org/apache/ofbiz/base/util/template/XslTransform.java | 4 ++++
.../java/org/apache/ofbiz/entity/util/EntitySaxReader.java | 9 ++++++++-
.../main/java/org/apache/ofbiz/minilang/MiniLangUtil.java | 4 ++++
.../main/java/org/apache/ofbiz/security/SecuredUpload.java | 4 ++++
.../main/java/org/apache/ofbiz/service/ModelService.java | 2 ++
.../org/apache/ofbiz/service/engine/SOAPClientEngine.java | 5 ++++-
.../org/apache/ofbiz/webapp/event/SOAPEventHandler.java | 10 ++++++++--
.../java/org/apache/ofbiz/webapp/view/ApacheFopWorker.java | 4 ++++
.../java/org/apache/ofbiz/webtools/WebToolsServices.java | 2 ++
13 files changed, 62 insertions(+), 7 deletions(-)
diff --git a/applications/accounting/src/main/java/org/apache/ofbiz/accounting/thirdparty/eway/GatewayResponse.java b/applications/accounting/src/main/java/org/apache/ofbiz/accounting/thirdparty/eway/GatewayResponse.java
index 27c3ac24ec..8fbbcc62af 100644
--- a/applications/accounting/src/main/java/org/apache/ofbiz/accounting/thirdparty/eway/GatewayResponse.java
+++ b/applications/accounting/src/main/java/org/apache/ofbiz/accounting/thirdparty/eway/GatewayResponse.java
@@ -23,6 +23,7 @@ import java.math.BigDecimal;
import java.math.RoundingMode;
import java.util.Locale;
+import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
@@ -165,14 +166,13 @@ public class GatewayResponse {
public GatewayResponse(InputStream xmlstream, GatewayRequest req) throws Exception {
DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance();
- // Below is an answer to a codeQL action on GH reporting a possible XXE
- // I have a doubt about "load-external-dtd" feature because I did not test the changes.
builderFactory.setValidating(true);
builderFactory.setNamespaceAware(true);
builderFactory.setAttribute("http://xml.org/sax/features/validation", true);
builderFactory.setAttribute("http://apache.org/xml/features/validation/schema", true);
+ builderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
builderFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
builderFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
builderFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
diff --git a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilHtml.java b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilHtml.java
index 2d6288496d..f16db4b957 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilHtml.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilHtml.java
@@ -69,6 +69,8 @@ public final class UtilHtml {
*/
public static List<String> hasUnclosedTag(String content) {
XMLInputFactory inputFactory = XMLInputFactory.newInstance();
+ inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
+ inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
XMLEventReader eventReader = null;
List<String> errorList = new ArrayList<>();
try {
diff --git a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
index 085d1db45e..c6e0440b01 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
@@ -37,6 +37,7 @@ import java.util.Set;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
+import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
@@ -226,6 +227,9 @@ public final class UtilXml {
sb.append("</xsl:template>\n</xsl:stylesheet>\n");
ByteArrayInputStream bis = new ByteArrayInputStream(sb.toString().getBytes());
TransformerFactory transformerFactory = TransformerFactory.newInstance();
+ transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+ transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
return transformerFactory.newTransformer(new StreamSource(bis));
}
@@ -460,6 +464,7 @@ public final class UtilXml {
factory.setAttribute("http://xml.org/sax/features/validation", validate);
factory.setAttribute("http://apache.org/xml/features/validation/schema", validate);
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
@@ -589,6 +594,9 @@ public final class UtilXml {
parser.setFeature("http://xml.org/sax/features/validation", validate);
parser.setFeature("http://apache.org/xml/features/validation/schema", validate);
parser.setFeature("http://apache.org/xml/features/dom/defer-node-expansion", false);
+ parser.setFeature("http://xml.org/sax/features/external-general-entities", false);
+ parser.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+ parser.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
// with a SchemaUrl, a URL object
if (validate) {
@@ -617,9 +625,9 @@ public final class UtilXml {
public static Document makeEmptyXmlDocument(String rootElementName) {
Document document = null;
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-
factory.setValidating(true);
try {
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
DocumentBuilder builder = factory.newDocumentBuilder();
document = builder.newDocument();
@@ -1273,6 +1281,9 @@ public final class UtilXml {
TransformerFactory tf = TransformerFactory.newInstance();
Transformer transformer;
try {
+ tf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+ tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
transformer = tf.newTransformer();
transformer.setOutputProperty(OutputKeys.ENCODING, "UTF-8");
transformer.setOutputProperty(OutputKeys.INDENT, "yes");
diff --git a/framework/base/src/main/java/org/apache/ofbiz/base/util/string/UelFunctions.java b/framework/base/src/main/java/org/apache/ofbiz/base/util/string/UelFunctions.java
index 273127bac7..e3f355bada 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/string/UelFunctions.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/string/UelFunctions.java
@@ -36,6 +36,8 @@ import java.util.Map;
import java.util.TimeZone;
import javax.el.FunctionMapper;
+
+import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
@@ -367,6 +369,7 @@ public class UelFunctions {
URL url = FlexibleLocation.resolveLocation(str);
if (url != null) {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
@@ -442,6 +445,9 @@ public class UelFunctions {
sb.append("</xsl:template>\n</xsl:stylesheet>\n");
ByteArrayInputStream bis = new ByteArrayInputStream(sb.toString().getBytes(StandardCharsets.UTF_8));
TransformerFactory transformerFactory = TransformerFactory.newInstance();
+ transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+ transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
try (ByteArrayOutputStream os = new ByteArrayOutputStream();) {
UtilXml.transformDomDocument(transformerFactory.newTransformer(new StreamSource(bis)), node, os);
return os.toString();
diff --git a/framework/base/src/main/java/org/apache/ofbiz/base/util/template/XslTransform.java b/framework/base/src/main/java/org/apache/ofbiz/base/util/template/XslTransform.java
index 20a93092f4..53cba52653 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/template/XslTransform.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/template/XslTransform.java
@@ -60,6 +60,10 @@ public final class XslTransform {
pfactory.setXIncludeAware(true);
XMLReader reader = null;
try {
+ pfactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ pfactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+ pfactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+ pfactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
reader = pfactory.newSAXParser().getXMLReader();
} catch (Exception e) {
throw new TransformerException("Error creating SAX parser/reader", e);
diff --git a/framework/entity/src/main/java/org/apache/ofbiz/entity/util/EntitySaxReader.java b/framework/entity/src/main/java/org/apache/ofbiz/entity/util/EntitySaxReader.java
index 1ae45cdd90..740c91cc87 100644
--- a/framework/entity/src/main/java/org/apache/ofbiz/entity/util/EntitySaxReader.java
+++ b/framework/entity/src/main/java/org/apache/ofbiz/entity/util/EntitySaxReader.java
@@ -35,6 +35,7 @@ import java.util.LinkedList;
import java.util.List;
import java.util.Map;
+import javax.xml.XMLConstants;
import javax.xml.parsers.ParserConfigurationException;
import javax.xml.parsers.SAXParser;
import javax.xml.parsers.SAXParserFactory;
@@ -265,7 +266,13 @@ public class EntitySaxReader extends DefaultHandler {
private long parse(InputStream is, String docDescription) throws SAXException, java.io.IOException {
SAXParser parser;
try {
- parser = SAXParserFactory.newInstance().newSAXParser();
+ SAXParserFactory factory = SAXParserFactory.newInstance();
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+ factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+ factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+ factory.setXIncludeAware(false);
+ parser = factory.newSAXParser();
} catch (ParserConfigurationException pce) {
throw new SAXException("Unable to create the SAX parser", pce);
}
diff --git a/framework/minilang/src/main/java/org/apache/ofbiz/minilang/MiniLangUtil.java b/framework/minilang/src/main/java/org/apache/ofbiz/minilang/MiniLangUtil.java
index bdaef4033a..719802ff5a 100644
--- a/framework/minilang/src/main/java/org/apache/ofbiz/minilang/MiniLangUtil.java
+++ b/framework/minilang/src/main/java/org/apache/ofbiz/minilang/MiniLangUtil.java
@@ -29,6 +29,7 @@ import java.util.Locale;
import java.util.Set;
import java.util.TimeZone;
+import javax.xml.XMLConstants;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.stream.StreamSource;
@@ -282,6 +283,9 @@ public final class MiniLangUtil {
try {
styleSheetURL = FlexibleLocation.resolveLocation("component://minilang/config/MiniLang.xslt");
TransformerFactory transformerFactory = TransformerFactory.newInstance();
+ transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+ transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
try (InputStream styleSheetInStream = styleSheetURL.openStream()) {
transformer = transformerFactory.newTransformer(new StreamSource(styleSheetInStream));
}
diff --git a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
index 5b711676be..c1a1a20dea 100644
--- a/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
+++ b/framework/security/src/main/java/org/apache/ofbiz/security/SecuredUpload.java
@@ -61,6 +61,7 @@ import java.util.zip.Inflater;
import javax.imageio.ImageIO;
import javax.imageio.ImageReader;
import javax.imageio.stream.ImageInputStream;
+import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
@@ -1311,9 +1312,12 @@ public class SecuredUpload {
try {
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
// Harden against XXE and DOCTYPE-based injection attacks
+ dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+ dbf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+ dbf.setXIncludeAware(false);
dbf.setExpandEntityReferences(false);
dbf.setNamespaceAware(true);
DocumentBuilder db = dbf.newDocumentBuilder();
diff --git a/framework/service/src/main/java/org/apache/ofbiz/service/ModelService.java b/framework/service/src/main/java/org/apache/ofbiz/service/ModelService.java
index 8b8ae0bf58..c5fa289c29 100644
--- a/framework/service/src/main/java/org/apache/ofbiz/service/ModelService.java
+++ b/framework/service/src/main/java/org/apache/ofbiz/service/ModelService.java
@@ -58,6 +58,7 @@ import javax.wsdl.extensions.soap.SOAPBinding;
import javax.wsdl.extensions.soap.SOAPBody;
import javax.wsdl.extensions.soap.SOAPOperation;
import javax.wsdl.factory.WSDLFactory;
+import javax.xml.XMLConstants;
import javax.xml.namespace.QName;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
@@ -1999,6 +2000,7 @@ public class ModelService extends AbstractMap<String, Object> implements Seriali
DocumentBuilder builder = null;
Document document = null;
try {
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
builder = factory.newDocumentBuilder();
document = builder.newDocument();
} catch (Exception e) {
diff --git a/framework/service/src/main/java/org/apache/ofbiz/service/engine/SOAPClientEngine.java b/framework/service/src/main/java/org/apache/ofbiz/service/engine/SOAPClientEngine.java
index ab5e5d1f0d..d3db5eb641 100644
--- a/framework/service/src/main/java/org/apache/ofbiz/service/engine/SOAPClientEngine.java
+++ b/framework/service/src/main/java/org/apache/ofbiz/service/engine/SOAPClientEngine.java
@@ -136,7 +136,10 @@ public final class SOAPClientEngine extends GenericAsyncEngine {
try {
String xmlParameters = SoapSerializer.serialize(parameterMap);
- XMLStreamReader reader = XMLInputFactory.newInstance().createXMLStreamReader(new StringReader(xmlParameters));
+ XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance();
+ xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
+ xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+ XMLStreamReader reader = xmlInputFactory.createXMLStreamReader(new StringReader(xmlParameters));
OMXMLParserWrapper builder = OMXMLBuilderFactory.createStAXOMBuilder(reader);
parameterSer = builder.getDocumentElement();
} catch (Exception e) {
diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/SOAPEventHandler.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/SOAPEventHandler.java
index 1716340bfe..ea7be549b4 100644
--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/SOAPEventHandler.java
+++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/event/SOAPEventHandler.java
@@ -237,7 +237,10 @@ public class SOAPEventHandler implements EventHandler {
}
String xmlResults = SoapSerializer.serialize(serviceResults);
//Debug.logInfo("xmlResults ==================" + xmlResults, MODULE);
- XMLStreamReader reader = XMLInputFactory.newInstance().createXMLStreamReader(new StringReader(xmlResults));
+ XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance();
+ xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
+ xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+ XMLStreamReader reader = xmlInputFactory.createXMLStreamReader(new StringReader(xmlResults));
OMXMLParserWrapper resultsBuilder = OMXMLBuilderFactory.createStAXOMBuilder(OMAbstractFactory.getOMFactory(),
reader);
OMElement resultSer = resultsBuilder.getDocumentElement();
@@ -290,7 +293,10 @@ public class SOAPEventHandler implements EventHandler {
// setup the response
res.setContentType("text/xml");
String xmlResults = SoapSerializer.serialize(object);
- XMLStreamReader xmlReader = XMLInputFactory.newInstance().createXMLStreamReader(new StringReader(xmlResults));
+ XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance();
+ xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
+ xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+ XMLStreamReader xmlReader = xmlInputFactory.createXMLStreamReader(new StringReader(xmlResults));
OMXMLParserWrapper resultsBuilder = OMXMLBuilderFactory.createStAXOMBuilder(OMAbstractFactory.getOMFactory(), xmlReader);
OMElement resultSer = resultsBuilder.getDocumentElement();
diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/view/ApacheFopWorker.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/view/ApacheFopWorker.java
index 1056ddf898..0bd0071f0b 100644
--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/view/ApacheFopWorker.java
+++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/view/ApacheFopWorker.java
@@ -26,6 +26,7 @@ import java.io.InputStream;
import java.io.OutputStream;
import java.net.URL;
+import javax.xml.XMLConstants;
import javax.xml.transform.Result;
import javax.xml.transform.Source;
import javax.xml.transform.Transformer;
@@ -165,6 +166,9 @@ public final class ApacheFopWorker {
Result res = new SAXResult(fop.getDefaultHandler());
try {
TransformerFactory factory = TransformerFactory.newInstance();
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+ factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
Transformer transformer;
if (stylesheet == null) {
transformer = factory.newTransformer();
diff --git a/framework/webtools/src/main/java/org/apache/ofbiz/webtools/WebToolsServices.java b/framework/webtools/src/main/java/org/apache/ofbiz/webtools/WebToolsServices.java
index 84a60eec73..e77f79e810 100644
--- a/framework/webtools/src/main/java/org/apache/ofbiz/webtools/WebToolsServices.java
+++ b/framework/webtools/src/main/java/org/apache/ofbiz/webtools/WebToolsServices.java
@@ -44,6 +44,7 @@ import java.util.ResourceBundle;
import java.util.Set;
import java.util.TreeSet;
+import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
@@ -166,6 +167,7 @@ public class WebToolsServices {
factory.setAttribute("http://xml.org/sax/features/validation", true);
factory.setAttribute("http://apache.org/xml/features/validation/schema", true);
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
(ofbiz-framework) 03/03: Fixed: Wrap setAttribute(ACCESS_EXTERNAL_DTD, ...) calls to catch IllegalArgumentException thrown by older versions of Xalan/Saxon that predate JAXP 1.5
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 86c6f3a4f4c8d4fcfb5b5c44ec259743ba4dcd19
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Mon Apr 27 18:14:31 2026 +0200
Fixed: Wrap setAttribute(ACCESS_EXTERNAL_DTD, ...) calls to catch IllegalArgumentException thrown by older versions of Xalan/Saxon that predate JAXP 1.5
---
.../main/java/org/apache/ofbiz/base/util/UtilXml.java | 16 ++++++++++++----
.../org/apache/ofbiz/base/util/string/UelFunctions.java | 8 ++++++--
.../apache/ofbiz/base/util/template/XslTransform.java | 8 ++++++--
.../java/org/apache/ofbiz/minilang/MiniLangUtil.java | 8 ++++++--
.../org/apache/ofbiz/webapp/view/ApacheFopWorker.java | 8 ++++++--
5 files changed, 36 insertions(+), 12 deletions(-)
diff --git a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
index c6e0440b01..6107279584 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
@@ -228,8 +228,12 @@ public final class UtilXml {
ByteArrayInputStream bis = new ByteArrayInputStream(sb.toString().getBytes());
TransformerFactory transformerFactory = TransformerFactory.newInstance();
transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
- transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
- transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+ try {
+ transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+ transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+ } catch (IllegalArgumentException e) {
+ Debug.logWarning("TransformerFactory does not support ACCESS_EXTERNAL_* attributes: " + e.getMessage(), MODULE);
+ }
return transformerFactory.newTransformer(new StreamSource(bis));
}
@@ -1282,8 +1286,12 @@ public final class UtilXml {
Transformer transformer;
try {
tf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
- tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
- tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+ try {
+ tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+ tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+ } catch (IllegalArgumentException e) {
+ Debug.logWarning("TransformerFactory does not support ACCESS_EXTERNAL_* attributes: " + e.getMessage(), MODULE);
+ }
transformer = tf.newTransformer();
transformer.setOutputProperty(OutputKeys.ENCODING, "UTF-8");
transformer.setOutputProperty(OutputKeys.INDENT, "yes");
diff --git a/framework/base/src/main/java/org/apache/ofbiz/base/util/string/UelFunctions.java b/framework/base/src/main/java/org/apache/ofbiz/base/util/string/UelFunctions.java
index e3f355bada..ee8de0fa5d 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/string/UelFunctions.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/string/UelFunctions.java
@@ -446,8 +446,12 @@ public class UelFunctions {
ByteArrayInputStream bis = new ByteArrayInputStream(sb.toString().getBytes(StandardCharsets.UTF_8));
TransformerFactory transformerFactory = TransformerFactory.newInstance();
transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
- transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
- transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+ try {
+ transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+ transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+ } catch (IllegalArgumentException e) {
+ Debug.logWarning("TransformerFactory does not support ACCESS_EXTERNAL_* attributes: " + e.getMessage(), MODULE);
+ }
try (ByteArrayOutputStream os = new ByteArrayOutputStream();) {
UtilXml.transformDomDocument(transformerFactory.newTransformer(new StreamSource(bis)), node, os);
return os.toString();
diff --git a/framework/base/src/main/java/org/apache/ofbiz/base/util/template/XslTransform.java b/framework/base/src/main/java/org/apache/ofbiz/base/util/template/XslTransform.java
index 53cba52653..ec56f0f368 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/template/XslTransform.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/template/XslTransform.java
@@ -50,8 +50,12 @@ public final class XslTransform {
String result = null;
TransformerFactory tfactory = TransformerFactory.newInstance();
tfactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
- tfactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
- tfactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+ try {
+ tfactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+ tfactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+ } catch (IllegalArgumentException e) {
+ Debug.logWarning("TransformerFactory does not support ACCESS_EXTERNAL_* attributes: " + e.getMessage(), MODULE);
+ }
if (tfactory.getFeature(SAXSource.FEATURE)) {
// setup for xml data file preprocessing to be able to xinclude
SAXParserFactory pfactory = SAXParserFactory.newInstance();
diff --git a/framework/minilang/src/main/java/org/apache/ofbiz/minilang/MiniLangUtil.java b/framework/minilang/src/main/java/org/apache/ofbiz/minilang/MiniLangUtil.java
index 719802ff5a..70e695e4a7 100644
--- a/framework/minilang/src/main/java/org/apache/ofbiz/minilang/MiniLangUtil.java
+++ b/framework/minilang/src/main/java/org/apache/ofbiz/minilang/MiniLangUtil.java
@@ -284,8 +284,12 @@ public final class MiniLangUtil {
styleSheetURL = FlexibleLocation.resolveLocation("component://minilang/config/MiniLang.xslt");
TransformerFactory transformerFactory = TransformerFactory.newInstance();
transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
- transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
- transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+ try {
+ transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+ transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+ } catch (IllegalArgumentException e) {
+ Debug.logWarning("TransformerFactory does not support ACCESS_EXTERNAL_* attributes: " + e.getMessage(), MODULE);
+ }
try (InputStream styleSheetInStream = styleSheetURL.openStream()) {
transformer = transformerFactory.newTransformer(new StreamSource(styleSheetInStream));
}
diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/view/ApacheFopWorker.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/view/ApacheFopWorker.java
index 0bd0071f0b..a1ad59e0ab 100644
--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/view/ApacheFopWorker.java
+++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/view/ApacheFopWorker.java
@@ -167,8 +167,12 @@ public final class ApacheFopWorker {
try {
TransformerFactory factory = TransformerFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
- factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
- factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+ try {
+ factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+ factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+ } catch (IllegalArgumentException e) {
+ Debug.logWarning("TransformerFactory does not support ACCESS_EXTERNAL_* attributes: " + e.getMessage(), MODULE);
+ }
Transformer transformer;
if (stylesheet == null) {
transformer = factory.newTransformer();