You are viewing a plain text version of this content. The canonical link for it is here.
Posted to derby-commits@db.apache.org by bp...@apache.org on 2015/07/04 22:12:44 UTC
svn commit: r1689194 - in
/db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang:
XMLXXETest.java xmlOptimizerXXE1.trace xmlOptimizerXXE1Payload.trace
xmlOptimizerXXE2.trace
Author: bpendleton
Date: Sat Jul 4 20:12:43 2015
New Revision: 1689194
URL: http://svn.apache.org/r1689194
Log:
DERBY-6810: Add regression tests for XXE vulnerability
This change adds tests which provoke XML External Entity vulnerabilities
in the XmlVTI class. One test demonstrates a file access vulnerability;
the other test attempts the "billion laughs" attack. These are the XmlVTI
versions of similar tests added in revision 1685313.
These new tests exercise error-handling code paths in XmlVTI and hence
are related to (and serve as tests of) the changes made by DERBY-6820.
Added:
db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE1.trace (with props)
db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE1Payload.trace (with props)
db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE2.trace (with props)
Modified:
db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/XMLXXETest.java
Modified: db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/XMLXXETest.java
URL: http://svn.apache.org/viewvc/db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/XMLXXETest.java?rev=1689194&r1=1689193&r2=1689194&view=diff
==============================================================================
--- db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/XMLXXETest.java (original)
+++ db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/XMLXXETest.java Sat Jul 4 20:12:43 2015
@@ -21,6 +21,7 @@ package org.apache.derbyTesting.function
import java.io.File;
import java.io.PrintWriter;
+import java.net.URL;
import java.sql.CallableStatement;
import java.sql.Connection;
@@ -39,6 +40,7 @@ import org.apache.derbyTesting.junit.Bas
import org.apache.derbyTesting.junit.BaseTestSuite;
import org.apache.derbyTesting.junit.JDBC;
import org.apache.derbyTesting.junit.SecurityManagerSetup;
+import org.apache.derbyTesting.junit.SupportFilesSetup;
import org.apache.derbyTesting.junit.TestConfiguration;
import org.apache.derbyTesting.junit.XML;
@@ -72,7 +74,16 @@ public final class XMLXXETest extends Ba
if (!XML.classpathMeetsXMLReqs())
return suite;
- suite.addTest(TestConfiguration.defaultSuite(XMLXXETest.class));
+ String[] testFiles = new String[] {
+ "functionTests/tests/lang/xmlOptimizerXXE1Payload.trace",
+ "functionTests/tests/lang/xmlOptimizerXXE1.trace",
+ "functionTests/tests/lang/xmlOptimizerXXE2.trace"
+ };
+
+ suite.addTest( new SupportFilesSetup(
+ TestConfiguration.defaultSuite(XMLXXETest.class),
+ testFiles ) );
+
return SecurityManagerSetup.noSecurityManager(suite);
}
@@ -150,4 +161,103 @@ String xmlBillionLaughs = "insert into x
// "select xmlserialize(xml_col as clob) from xml_billion_laughs");
}
+ public void testDerby6807FileAccessVTI()
+ throws Exception
+ {
+ String VULNERABLE_XML = "xmlOptimizerXXE1.trace";
+ URL traceURL = SupportFilesSetup.getReadOnlyURL( VULNERABLE_XML );
+ //URL payloadURL = SupportFilesSetup.getReadOnlyURL(
+ // "xmlOptimizerXXE1Payload.trace" );
+
+ Statement s = createStatement();
+ s.execute(
+ "create function decorationURLChildOnly\n" +
+ "(\n" +
+ " urlString varchar( 32672 ),\n" +
+ " rowTag varchar( 32672 ),\n" +
+ " childTags varchar( 32672 )...\n" +
+ ")\n" +
+ "returns table\n" +
+ "(\n" +
+ " conglomerateName varchar( 36 ),\n" +
+ " joinStrategy varchar( 200 ),\n" +
+ " estimatedCost double,\n" +
+ " estimatedRowCount varchar( 200 )\n" +
+ ")\n" +
+ "language java parameter style derby_jdbc_result_set no sql\n" +
+ "external name 'org.apache.derby.vti.XmlVTI.xmlVTIFromURL'\n"
+ );
+ s.execute(
+ "create view decorationURLChildOnly as\n" +
+ "select * from table\n" +
+ "(\n" +
+ " decorationURLChildOnly\n" +
+ " (\n" +
+ " '" + traceURL.toString() + "',\n" +
+ " 'decoration',\n" +
+ " 'decConglomerateName', 'decJoinStrategy',\n" +
+ " 'ceEstimatedCost', 'ceEstimatedRowCount'\n" +
+ " )\n" +
+ ") v\n"
+ );
+ ResultSet rs = s.executeQuery(
+ "select distinct conglomerateName, joinStrategy," +
+ " estimatedCost, estimatedRowCount\n" +
+ "from decorationURLChildOnly\n" +
+ "where conglomerateName like '%_A' and " +
+ " estimatedCost is not null\n" +
+ "order by conglomerateName, joinStrategy, " +
+ " estimatedCost, estimatedRowCount\n"
+ );
+ assertTrue( rs.next() );
+
+ // This next line will need to change once DERBY-6807 is fixed:
+ assertEquals( "SECRET DATA SHOULD NOT HAVE BEEN EXPOSED",
+ rs.getString( 4 ).trim() );
+
+ assertFalse( rs.next() );
+ }
+
+ public void testDerby6807BillionLaughsVTI()
+ throws Exception
+ {
+ String VULNERABLE_XML = "xmlOptimizerXXE2.trace";
+ URL traceURL = SupportFilesSetup.getReadOnlyURL( VULNERABLE_XML );
+
+ Statement s = createStatement();
+ s.execute(
+ "create function lolzURL\n" +
+ "(\n" +
+ " urlString varchar( 32672 ),\n" +
+ " rowTag varchar( 32672 ),\n" +
+ " childTags varchar( 32672 )...\n" +
+ ")\n" +
+ "returns table\n" +
+ "(\n" +
+ " lolz varchar( 32000 )\n" +
+ ")\n" +
+ "language java parameter style derby_jdbc_result_set no sql\n" +
+ "external name 'org.apache.derby.vti.XmlVTI.xmlVTIFromURL'\n"
+ );
+ s.execute(
+ "create view lolzURL as\n" +
+ "select * from table\n" +
+ "(\n" +
+ " lolzURL\n" +
+ " (\n" +
+ " '" + traceURL.toString() + "',\n" +
+ " 'lolz'\n" +
+ " )\n" +
+ ") v\n"
+ );
+ try {
+ ResultSet rs = s.executeQuery( "select lolz from lolzURL" );
+ assertTrue( rs.next() );
+
+ // This next line will need to change once DERBY-6807 is fixed:
+ fail( "Expected SAXParseException" );
+ } catch ( Throwable e ) {
+ assertTrue( e.getMessage().indexOf( "entity expansions" ) > 0 );
+ }
+ }
}
Added: db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE1.trace
URL: http://svn.apache.org/viewvc/db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE1.trace?rev=1689194&view=auto
==============================================================================
--- db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE1.trace (added)
+++ db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE1.trace Sat Jul 4 20:12:43 2015
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:extin/xmlOptimizerXXE1Payload.trace">]>
+<optimizerTrace>
+ <statement stmtID="1">
+ <stmtText>select s.a from t, s where t.a = s.a</stmtText>
+ <queryBlock qbID="1" qbOptimizerID="1141500277" qbStartTime="Fri Jul 05 06:42:09 PDT 2013">
+ <qbOptimizable qboTableNumber="0">"APP"."T"</qbOptimizable>
+ <joinOrder joComplete="true">
+ <joSlot>"APP"."T"</joSlot>
+ <joSlot>"APP"."S"</joSlot>
+ <decoration decConglomerateName="S_A" decJoinStrategy="HASH" decTableName="APP.S">
+ <decKey>A</decKey>
+ <decConglomerateCost name="S_A">
+ <ceEstimatedCost>20.1395</ceEstimatedCost>
+ <ceEstimatedRowCount>&xxe;</ceEstimatedRowCount>
+ <ceSingleScanRowCount>6.0</ceSingleScanRowCount>
+ <decExtraFirstColumnPreds selCount="0" selSelectivity="1.0"/>
+ <decExtraFirstStartStopPreds selCount="0" selSelectivity="1.0"/>
+ <decStartStopPred selCount="0" selSelectivity="1.0"/>
+ <decExtraQualifiers selCount="0" selSelectivity="1.0"/>
+ <decExtraNonQualifiers selCount="0" selSelectivity="0.1"/>
+ </decConglomerateCost>
+ </decoration>
+ <planCost pcComplete="true" pcType="withoutSortAvoidance">
+ <pcSummary>( "APP"."T_A" # "APP"."S_A" )</pcSummary>
+ <ceEstimatedCost>40.179</ceEstimatedCost>
+ <ceEstimatedRowCount>3</ceEstimatedRowCount>
+ <ceSingleScanRowCount>0.6000000000000001</ceSingleScanRowCount>
+ </planCost>
+ </joinOrder>
+ </queryBlock>
+ </statement>
+</optimizerTrace>
Propchange: db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE1.trace
------------------------------------------------------------------------------
svn:eol-style = native
Propchange: db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE1.trace
------------------------------------------------------------------------------
svn:mime-type = text/xml
Added: db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE1Payload.trace
URL: http://svn.apache.org/viewvc/db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE1Payload.trace?rev=1689194&view=auto
==============================================================================
--- db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE1Payload.trace (added)
+++ db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE1Payload.trace Sat Jul 4 20:12:43 2015
@@ -0,0 +1 @@
+SECRET DATA SHOULD NOT HAVE BEEN EXPOSED
Propchange: db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE1Payload.trace
------------------------------------------------------------------------------
svn:eol-style = native
Propchange: db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE1Payload.trace
------------------------------------------------------------------------------
svn:mime-type = text/xml
Added: db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE2.trace
URL: http://svn.apache.org/viewvc/db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE2.trace?rev=1689194&view=auto
==============================================================================
--- db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE2.trace (added)
+++ db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE2.trace Sat Jul 4 20:12:43 2015
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!DOCTYPE lolz [
+ <!ENTITY lol "lol">
+ <!ELEMENT lolz (#PCDATA)>
+ <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
+ <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
+ <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
+ <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
+ <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
+ <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
+ <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
+ <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
+ <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
+]>
+<lolz>&lol9;</lolz>
Propchange: db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE2.trace
------------------------------------------------------------------------------
svn:eol-style = native
Propchange: db/derby/code/trunk/java/testing/org/apache/derbyTesting/functionTests/tests/lang/xmlOptimizerXXE2.trace
------------------------------------------------------------------------------
svn:mime-type = text/xml