You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jmeter.apache.org by pm...@apache.org on 2019/10/01 09:23:55 UTC
[jmeter] branch master updated (178f633 -> ff43e5c)
This is an automated email from the ASF dual-hosted git repository.
pmouawad pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/jmeter.git.
from 178f633 Fix Sonar warning: Make field private
new 8323941 Fix sonar security warning: False positive in the context of JMeter
new d467f53 Bug 63793 - Fix unsecure XML Parsing
new bccc3e0 Add test for unsecure XML loading
new ff43e5c Revert import order
The 4 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../java/org/apache/jmeter/assertions/XMLAssertion.java | 4 +++-
.../org/apache/jmeter/assertions/XMLSchemaAssertion.java | 3 ++-
.../org/apache/jmeter/assertions/XmlAssertionTest.java | 14 ++++++++++++++
.../java/org/apache/jmeter/gui/action/SchematicView.java | 2 ++
.../apache/jmeter/gui/action/template/TemplateManager.java | 2 ++
.../main/java/org/apache/jmeter/util/JsseSSLManager.java | 2 +-
.../src/main/java/org/apache/jmeter/util/XPathUtil.java | 13 ++++++++++---
.../org/apache/jmeter/functions/XPathFileContainer.java | 5 ++++-
.../jmeter/protocol/http/proxy/DefaultSamplerCreator.java | 2 ++
.../protocol/jms/sampler/render/ObjectMessageRenderer.java | 1 +
xdocs/changes.xml | 11 +++++++++++
11 files changed, 52 insertions(+), 7 deletions(-)
[jmeter] 02/04: Bug 63793 - Fix unsecure XML Parsing
Posted by pm...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
pmouawad pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/jmeter.git
commit d467f5368f65aca65d6ebd81f3d9fb7bec4967b4
Author: pmouawad <p....@ubik-ingenierie.com>
AuthorDate: Tue Oct 1 10:45:56 2019 +0200
Bug 63793 - Fix unsecure XML Parsing
---
.../org/apache/jmeter/assertions/XMLAssertion.java | 6 +++++-
.../apache/jmeter/assertions/XMLSchemaAssertion.java | 3 ++-
.../org/apache/jmeter/gui/action/SchematicView.java | 2 ++
.../jmeter/gui/action/template/TemplateManager.java | 2 ++
.../main/java/org/apache/jmeter/util/XPathUtil.java | 18 ++++++++++++------
.../apache/jmeter/functions/XPathFileContainer.java | 5 ++++-
.../protocol/http/proxy/DefaultSamplerCreator.java | 2 ++
.../jms/sampler/render/ObjectMessageRenderer.java | 1 +
xdocs/changes.xml | 11 +++++++++++
9 files changed, 41 insertions(+), 9 deletions(-)
diff --git a/src/components/src/main/java/org/apache/jmeter/assertions/XMLAssertion.java b/src/components/src/main/java/org/apache/jmeter/assertions/XMLAssertion.java
index c200b92..4eb9554 100644
--- a/src/components/src/main/java/org/apache/jmeter/assertions/XMLAssertion.java
+++ b/src/components/src/main/java/org/apache/jmeter/assertions/XMLAssertion.java
@@ -22,6 +22,8 @@ import java.io.IOException;
import java.io.Serializable;
import java.io.StringReader;
+import javax.xml.XMLConstants;
+
import org.apache.jmeter.samplers.SampleResult;
import org.apache.jmeter.testelement.AbstractTestElement;
import org.apache.jmeter.testelement.ThreadListener;
@@ -46,7 +48,9 @@ public class XMLAssertion extends AbstractTestElement implements Serializable, A
@Override
protected XMLReader initialValue() {
try {
- return XMLReaderFactory.createXMLReader();
+ XMLReader reader = XMLReaderFactory.createXMLReader();
+ reader.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ return reader;
} catch (SAXException e) {
log.error("Error initializing XMLReader in XMLAssertion", e);
return null;
diff --git a/src/components/src/main/java/org/apache/jmeter/assertions/XMLSchemaAssertion.java b/src/components/src/main/java/org/apache/jmeter/assertions/XMLSchemaAssertion.java
index 3336366..b0d7781 100644
--- a/src/components/src/main/java/org/apache/jmeter/assertions/XMLSchemaAssertion.java
+++ b/src/components/src/main/java/org/apache/jmeter/assertions/XMLSchemaAssertion.java
@@ -22,6 +22,7 @@ import java.io.IOException;
import java.io.Serializable;
import java.io.StringReader;
+import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
@@ -102,7 +103,7 @@ public class XMLSchemaAssertion extends AbstractTestElement implements Serializa
parserFactory.setNamespaceAware(true);
parserFactory.setAttribute(JAXP_SCHEMA_LANGUAGE, W3C_XML_SCHEMA);
parserFactory.setAttribute(JAXP_SCHEMA_SOURCE, xsdFileName);
-
+ parserFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
// create a parser:
DocumentBuilder parser = parserFactory.newDocumentBuilder();
parser.setErrorHandler(new SAXErrorHandler(result));
diff --git a/src/core/src/main/java/org/apache/jmeter/gui/action/SchematicView.java b/src/core/src/main/java/org/apache/jmeter/gui/action/SchematicView.java
index 5d34c87..12726d1 100644
--- a/src/core/src/main/java/org/apache/jmeter/gui/action/SchematicView.java
+++ b/src/core/src/main/java/org/apache/jmeter/gui/action/SchematicView.java
@@ -33,6 +33,7 @@ import javax.swing.JMenu;
import javax.swing.JMenuItem;
import javax.swing.JOptionPane;
import javax.swing.MenuElement;
+import javax.xml.XMLConstants;
import javax.xml.transform.Source;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerFactory;
@@ -69,6 +70,7 @@ public class SchematicView extends AbstractAction implements MenuCreator {
throws Exception {
TransformerFactory factory = TransformerFactory.newInstance(
"net.sf.saxon.BasicTransformerFactory", Thread.currentThread().getContextClassLoader());
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
Source xslt;
if (!StringUtils.isEmpty(DEFAULT_XSL_FILE)) {
log.info("Will use file {} for Schematic View generation", DEFAULT_XSL_FILE);
diff --git a/src/core/src/main/java/org/apache/jmeter/gui/action/template/TemplateManager.java b/src/core/src/main/java/org/apache/jmeter/gui/action/template/TemplateManager.java
index 4c1699d..b1cfb9f 100644
--- a/src/core/src/main/java/org/apache/jmeter/gui/action/template/TemplateManager.java
+++ b/src/core/src/main/java/org/apache/jmeter/gui/action/template/TemplateManager.java
@@ -24,6 +24,7 @@ import java.util.HashMap;
import java.util.Map;
import java.util.TreeMap;
+import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
@@ -167,6 +168,7 @@ public class TemplateManager {
dbf.setNamespaceAware(true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+ dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
DocumentBuilder bd = dbf.newDocumentBuilder();
bd.setEntityResolver(new DefaultEntityResolver());
LoggingErrorHandler errorHandler = new LoggingErrorHandler(log, file);
diff --git a/src/core/src/main/java/org/apache/jmeter/util/XPathUtil.java b/src/core/src/main/java/org/apache/jmeter/util/XPathUtil.java
index 6bb8bc1..b82a32e 100644
--- a/src/core/src/main/java/org/apache/jmeter/util/XPathUtil.java
+++ b/src/core/src/main/java/org/apache/jmeter/util/XPathUtil.java
@@ -29,6 +29,7 @@ import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.List;
+import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
@@ -65,6 +66,9 @@ import org.xml.sax.InputSource;
import org.xml.sax.SAXException;
import org.xml.sax.SAXParseException;
+import com.github.benmanes.caffeine.cache.Caffeine;
+import com.github.benmanes.caffeine.cache.LoadingCache;
+
import net.sf.saxon.s9api.Processor;
import net.sf.saxon.s9api.SaxonApiException;
import net.sf.saxon.s9api.XPathExecutable;
@@ -72,9 +76,6 @@ import net.sf.saxon.s9api.XPathSelector;
import net.sf.saxon.s9api.XdmItem;
import net.sf.saxon.s9api.XdmNode;
import net.sf.saxon.s9api.XdmValue;
-
-import com.github.benmanes.caffeine.cache.Caffeine;
-import com.github.benmanes.caffeine.cache.LoadingCache;
/**
* This class provides a few utility methods for dealing with XML/XPath.
*/
@@ -115,12 +116,13 @@ public class XPathUtil {
* @return javax.xml.parsers.DocumentBuilderFactory
*/
private static synchronized DocumentBuilderFactory makeDocumentBuilderFactory(boolean validate, boolean whitespace,
- boolean namespace) {
+ boolean namespace) throws ParserConfigurationException {
if (XPathUtil.documentBuilderFactory == null || documentBuilderFactory.isValidating() != validate
|| documentBuilderFactory.isNamespaceAware() != namespace
|| documentBuilderFactory.isIgnoringElementContentWhitespace() != whitespace) {
// configure the document builder factory
documentBuilderFactory = DocumentBuilderFactory.newInstance();
+ documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
documentBuilderFactory.setValidating(validate);
documentBuilderFactory.setNamespaceAware(namespace);
documentBuilderFactory.setIgnoringElementContentWhitespace(whitespace);
@@ -309,7 +311,9 @@ public class XPathUtil {
private static String getNodeContent(Node node) {
StringWriter sw = new StringWriter();
try {
- Transformer t = TransformerFactory.newInstance().newTransformer();
+ TransformerFactory factory = TransformerFactory.newInstance();
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ Transformer t = factory.newTransformer();
t.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes");
t.transform(new DOMSource(node), new StreamResult(sw));
} catch (TransformerException e) {
@@ -731,7 +735,9 @@ public class XPathUtil {
*/
public static String formatXml(String xml){
try {
- Transformer serializer= TransformerFactory.newInstance().newTransformer();
+ TransformerFactory factory = TransformerFactory.newInstance();
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ Transformer serializer= factory.newTransformer();
serializer.setOutputProperty(OutputKeys.INDENT, "yes");
serializer.setOutputProperty("{http://xml.apache.org/xslt}indent-amount", "2");
Source xmlSource = new SAXSource(new InputSource(new StringReader(xml)));
diff --git a/src/functions/src/main/java/org/apache/jmeter/functions/XPathFileContainer.java b/src/functions/src/main/java/org/apache/jmeter/functions/XPathFileContainer.java
index 527dc83..eb4c338 100644
--- a/src/functions/src/main/java/org/apache/jmeter/functions/XPathFileContainer.java
+++ b/src/functions/src/main/java/org/apache/jmeter/functions/XPathFileContainer.java
@@ -23,6 +23,7 @@ import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
+import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
@@ -67,7 +68,9 @@ public class XPathFileContainer {
NodeList nl = null;
try ( FileInputStream fis = new FileInputStream(fileName);
BufferedInputStream bis = new BufferedInputStream(fis) ){
- DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+ DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ DocumentBuilder builder = factory.newDocumentBuilder();
nl = XPathUtil.selectNodeList(builder.parse(bis), xpath);
if(log.isDebugEnabled()) {
log.debug("found {}", nl.getLength());
diff --git a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/proxy/DefaultSamplerCreator.java b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/proxy/DefaultSamplerCreator.java
index 9e00f91..8aeb905 100644
--- a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/proxy/DefaultSamplerCreator.java
+++ b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/proxy/DefaultSamplerCreator.java
@@ -25,6 +25,7 @@ import java.net.MalformedURLException;
import java.net.URL;
import java.util.Map;
+import javax.xml.XMLConstants;
import javax.xml.parsers.ParserConfigurationException;
import javax.xml.parsers.SAXParser;
import javax.xml.parsers.SAXParserFactory;
@@ -237,6 +238,7 @@ public class DefaultSamplerCreator extends AbstractSamplerCreator {
private static boolean isPotentialXml(String postData) {
try {
SAXParserFactory spf = SAXParserFactory.newInstance();
+ spf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
SAXParser saxParser = spf.newSAXParser();
XMLReader xmlReader = saxParser.getXMLReader();
ErrorDetectionHandler detectionHandler =
diff --git a/src/protocol/jms/src/main/java/org/apache/jmeter/protocol/jms/sampler/render/ObjectMessageRenderer.java b/src/protocol/jms/src/main/java/org/apache/jmeter/protocol/jms/sampler/render/ObjectMessageRenderer.java
index 255eacf..af0473c 100644
--- a/src/protocol/jms/src/main/java/org/apache/jmeter/protocol/jms/sampler/render/ObjectMessageRenderer.java
+++ b/src/protocol/jms/src/main/java/org/apache/jmeter/protocol/jms/sampler/render/ObjectMessageRenderer.java
@@ -92,6 +92,7 @@ class ObjectMessageRenderer implements MessageRenderer<Serializable> {
/** Try to determine encoding based on XML prolog, if none <code>null</code> is returned. **/
protected String findEncoding(String filename) {
XMLInputFactory factory = XMLInputFactory.newInstance();
+ factory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE);
try (FileInputStream input = new FileInputStream(filename)) {
XMLStreamReader reader = factory.createXMLStreamReader(input);
return reader.getEncoding();
diff --git a/xdocs/changes.xml b/xdocs/changes.xml
index 86fda4e..e1b62c3 100644
--- a/xdocs/changes.xml
+++ b/xdocs/changes.xml
@@ -77,6 +77,16 @@ to view the last release notes of version 5.1.1.
<ul>
<li>HTTP(S) Test Script Recorder now appends number at end of names, while previously it added it at beginning. See <bugzilla>63450</bugzilla></li>
<li>When using XPath Assertion with an XPath expression returning a boolean, <code>True if nothing matches</code> had no effect and always returned true, see <bugzilla>63455</bugzilla></li>
+ <li>XML parsing now refuses unsecure XML, this has impacts on the following features:
+ <ul>
+ <li>XMLAssertion</li>
+ <li>XMLSchemAssertion</li>
+ <li>XPath function</li>
+ <li>XPath 1 & 2 Extractors</li>
+ <li>XPath 1 & 2 Assertions</li>
+ </ul>
+
+ </li>
</ul>
<!-- =================== Improvements =================== -->
@@ -234,6 +244,7 @@ to view the last release notes of version 5.1.1.
<li><bug>63751</bug>Correct a typo in Chinese translations. Reported by Jinliang Wang (wjl31802 at 126.com)</li>
<li><bug>63723</bug>Distributed testing: JMeter master ends distributed test though some threads still are active</li>
<li><bug>63614</bug>Distributed testing: Unable to generate Dashboard report at end of load test</li>
+ <li><bug>63793</bug>Fix unsecure XML Parsing</li>
</ul>
<!-- =================== Thanks =================== -->
[jmeter] 04/04: Revert import order
Posted by pm...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
pmouawad pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/jmeter.git
commit ff43e5c58e6c0b8fc9d30dd0f51dc07e75a60492
Author: pmouawad <p....@ubik-ingenierie.com>
AuthorDate: Tue Oct 1 11:23:36 2019 +0200
Revert import order
---
src/core/src/main/java/org/apache/jmeter/util/XPathUtil.java | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/src/core/src/main/java/org/apache/jmeter/util/XPathUtil.java b/src/core/src/main/java/org/apache/jmeter/util/XPathUtil.java
index b82a32e..9dd1366 100644
--- a/src/core/src/main/java/org/apache/jmeter/util/XPathUtil.java
+++ b/src/core/src/main/java/org/apache/jmeter/util/XPathUtil.java
@@ -66,9 +66,6 @@ import org.xml.sax.InputSource;
import org.xml.sax.SAXException;
import org.xml.sax.SAXParseException;
-import com.github.benmanes.caffeine.cache.Caffeine;
-import com.github.benmanes.caffeine.cache.LoadingCache;
-
import net.sf.saxon.s9api.Processor;
import net.sf.saxon.s9api.SaxonApiException;
import net.sf.saxon.s9api.XPathExecutable;
@@ -76,6 +73,10 @@ import net.sf.saxon.s9api.XPathSelector;
import net.sf.saxon.s9api.XdmItem;
import net.sf.saxon.s9api.XdmNode;
import net.sf.saxon.s9api.XdmValue;
+
+import com.github.benmanes.caffeine.cache.Caffeine;
+import com.github.benmanes.caffeine.cache.LoadingCache;
+
/**
* This class provides a few utility methods for dealing with XML/XPath.
*/
[jmeter] 01/04: Fix sonar security warning: False positive in the
context of JMeter
Posted by pm...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
pmouawad pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/jmeter.git
commit 8323941eb8005abba76ee0f6ad1773a309eaabf8
Author: pmouawad <p....@ubik-ingenierie.com>
AuthorDate: Tue Oct 1 09:59:04 2019 +0200
Fix sonar security warning: False positive in the context of JMeter
---
src/core/src/main/java/org/apache/jmeter/util/JsseSSLManager.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/core/src/main/java/org/apache/jmeter/util/JsseSSLManager.java b/src/core/src/main/java/org/apache/jmeter/util/JsseSSLManager.java
index dcedbd8..b36fa95 100644
--- a/src/core/src/main/java/org/apache/jmeter/util/JsseSSLManager.java
+++ b/src/core/src/main/java/org/apache/jmeter/util/JsseSSLManager.java
@@ -111,7 +111,7 @@ public class JsseSSLManager extends SSLManager {
}
HttpsURLConnection.setDefaultSSLSocketFactory(new HttpSSLProtocolSocketFactory(CPS));
- HttpsURLConnection.setDefaultHostnameVerifier((hostname, session) -> true);
+ HttpsURLConnection.setDefaultHostnameVerifier((hostname, session) -> true); // NOSONAR JMeter is a pentest and perf testing tool
log.debug("SSL stuff all set");
} catch (GeneralSecurityException ex) {
[jmeter] 03/04: Add test for unsecure XML loading
Posted by pm...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
pmouawad pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/jmeter.git
commit bccc3e05760930ab210da78feccb68f8830da6c9
Author: pmouawad <p....@ubik-ingenierie.com>
AuthorDate: Tue Oct 1 11:23:29 2019 +0200
Add test for unsecure XML loading
---
.../java/org/apache/jmeter/assertions/XMLAssertion.java | 4 +---
.../org/apache/jmeter/assertions/XmlAssertionTest.java | 14 ++++++++++++++
2 files changed, 15 insertions(+), 3 deletions(-)
diff --git a/src/components/src/main/java/org/apache/jmeter/assertions/XMLAssertion.java b/src/components/src/main/java/org/apache/jmeter/assertions/XMLAssertion.java
index 4eb9554..b5dbbc1 100644
--- a/src/components/src/main/java/org/apache/jmeter/assertions/XMLAssertion.java
+++ b/src/components/src/main/java/org/apache/jmeter/assertions/XMLAssertion.java
@@ -22,8 +22,6 @@ import java.io.IOException;
import java.io.Serializable;
import java.io.StringReader;
-import javax.xml.XMLConstants;
-
import org.apache.jmeter.samplers.SampleResult;
import org.apache.jmeter.testelement.AbstractTestElement;
import org.apache.jmeter.testelement.ThreadListener;
@@ -49,7 +47,7 @@ public class XMLAssertion extends AbstractTestElement implements Serializable, A
protected XMLReader initialValue() {
try {
XMLReader reader = XMLReaderFactory.createXMLReader();
- reader.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+ reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
return reader;
} catch (SAXException e) {
log.error("Error initializing XMLReader in XMLAssertion", e);
diff --git a/src/components/src/test/java/org/apache/jmeter/assertions/XmlAssertionTest.java b/src/components/src/test/java/org/apache/jmeter/assertions/XmlAssertionTest.java
index cd142bd..951a877 100644
--- a/src/components/src/test/java/org/apache/jmeter/assertions/XmlAssertionTest.java
+++ b/src/components/src/test/java/org/apache/jmeter/assertions/XmlAssertionTest.java
@@ -35,6 +35,10 @@ public class XmlAssertionTest extends JMeterTestCase {
private final String invalidXml = "<note><to>Tove</to><from>Jani</from><heading>Reminder</heading><body>Don't forget me this weekend!</body></note1>";
private final String validXml = "<note><to>Tove</to><from>Jani</from><heading>Reminder</heading><body>Don't forget me this weekend!</body></note>";
private final String noXml = "response Data";
+ private final String unsecureXML = "<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n" +
+ "<!DOCTYPE foo [\n" +
+ " <!ENTITY xxe SYSTEM \"file:///etc/passwd\" > ]>\n" +
+ "<foo>&xxe;</foo>";
@Before
public void setUp() {
@@ -47,6 +51,16 @@ public class XmlAssertionTest extends JMeterTestCase {
}
@Test
+ public void testUnsecureX() throws Exception {
+ sampleResult.setResponseData(unsecureXML, null);
+ result = assertion.getResult(sampleResult);
+ Assert.assertTrue(result.isFailure());
+ Assert.assertTrue(result.isError());
+ Assert.assertEquals("DOCTYPE is disallowed when the feature \"http://apache.org/xml/features/disallow-doctype-decl\" set to true.",
+ result.getFailureMessage());
+ }
+
+ @Test
public void testValidXML() throws Exception {
sampleResult.setResponseData(validXml, null);
result = assertion.getResult(sampleResult);