You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2018/11/23 14:44:46 UTC
[cxf] branch master updated: Set secure processing on XPathFactory
instances
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/master by this push:
new 3a0b939 Set secure processing on XPathFactory instances
3a0b939 is described below
commit 3a0b939b04d5e59388ff536ac93e7cf3f8793571
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Fri Nov 23 14:44:28 2018 +0000
Set secure processing on XPathFactory instances
---
core/src/main/java/org/apache/cxf/helpers/XPathUtils.java | 9 +++++++++
.../org/apache/cxf/ws/eventing/shared/utils/FilteringUtil.java | 9 +++++++++
.../apache/cxf/ws/security/wss4j/CryptoCoverageChecker.java | 6 ++++++
.../org/apache/cxf/ws/security/wss4j/CryptoCoverageUtil.java | 6 ++++++
.../security/wss4j/policyhandlers/AbstractBindingBuilder.java | 7 +++++++
.../AbstractSupportingTokenPolicyValidator.java | 7 +++++++
.../policyvalidators/RequiredElementsPolicyValidator.java | 7 +++++++
.../wss4j/policyvalidators/SecuredElementsPolicyValidator.java | 6 ++++++
.../fragment/language/FragmentDialectLanguageXPath10.java | 9 +++++++++
testutils/src/main/java/org/apache/cxf/test/XPathAssert.java | 9 ++++++++-
.../cxf/tools/wsdlto/databinding/jaxb/JAXBDataBinding.java | 9 ++++++++-
.../frontend/jaxws/customization/JAXWSBindingParser.java | 10 +++++++++-
12 files changed, 91 insertions(+), 3 deletions(-)
diff --git a/core/src/main/java/org/apache/cxf/helpers/XPathUtils.java b/core/src/main/java/org/apache/cxf/helpers/XPathUtils.java
index c5012bb..7475434 100644
--- a/core/src/main/java/org/apache/cxf/helpers/XPathUtils.java
+++ b/core/src/main/java/org/apache/cxf/helpers/XPathUtils.java
@@ -23,6 +23,7 @@ import java.security.AccessController;
import java.security.PrivilegedAction;
import java.util.Map;
+import javax.xml.XMLConstants;
import javax.xml.namespace.NamespaceContext;
import javax.xml.namespace.QName;
import javax.xml.xpath.XPath;
@@ -40,6 +41,14 @@ public class XPathUtils {
private static XPathFactory xpathFactory = XPathFactory.newInstance();
+ static {
+ try {
+ xpathFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+ } catch (javax.xml.xpath.XPathFactoryConfigurationException ex) {
+ // ignore
+ }
+ }
+
private XPath xpath;
public XPathUtils() {
diff --git a/rt/ws/eventing/src/main/java/org/apache/cxf/ws/eventing/shared/utils/FilteringUtil.java b/rt/ws/eventing/src/main/java/org/apache/cxf/ws/eventing/shared/utils/FilteringUtil.java
index 5ba546e..344b018 100644
--- a/rt/ws/eventing/src/main/java/org/apache/cxf/ws/eventing/shared/utils/FilteringUtil.java
+++ b/rt/ws/eventing/src/main/java/org/apache/cxf/ws/eventing/shared/utils/FilteringUtil.java
@@ -22,6 +22,7 @@ package org.apache.cxf.ws.eventing.shared.utils;
import java.util.Iterator;
import java.util.logging.Logger;
+import javax.xml.XMLConstants;
import javax.xml.soap.SOAPException;
import javax.xml.soap.SOAPMessage;
import javax.xml.xpath.XPath;
@@ -44,6 +45,14 @@ public final class FilteringUtil {
private static final Logger LOG = LogUtils.getLogger(FilteringUtil.class);
private static XPathFactory xPathFactory = XPathFactory.newInstance();
+ static {
+ try {
+ xPathFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+ } catch (javax.xml.xpath.XPathFactoryConfigurationException ex) {
+ // ignore
+ }
+ }
+
private FilteringUtil() {
}
diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/CryptoCoverageChecker.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/CryptoCoverageChecker.java
index ed6a90c..83cb147 100644
--- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/CryptoCoverageChecker.java
+++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/CryptoCoverageChecker.java
@@ -27,6 +27,7 @@ import java.util.HashSet;
import java.util.List;
import java.util.Map;
+import javax.xml.XMLConstants;
import javax.xml.namespace.QName;
import javax.xml.soap.SOAPEnvelope;
import javax.xml.soap.SOAPException;
@@ -178,6 +179,11 @@ public class CryptoCoverageChecker extends AbstractSoapInterceptor {
// XPathFactory and XPath are not thread-safe so we must recreate them
// each request.
final XPathFactory factory = XPathFactory.newInstance();
+ try {
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+ } catch (javax.xml.xpath.XPathFactoryConfigurationException ex) {
+ // ignore
+ }
final XPath xpath = factory.newXPath();
if (this.prefixMap != null) {
diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/CryptoCoverageUtil.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/CryptoCoverageUtil.java
index 6cbbf1a..b5e19ac 100644
--- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/CryptoCoverageUtil.java
+++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/CryptoCoverageUtil.java
@@ -26,6 +26,7 @@ import java.util.LinkedList;
import java.util.List;
import java.util.Map;
+import javax.xml.XMLConstants;
import javax.xml.xpath.XPath;
import javax.xml.xpath.XPathConstants;
import javax.xml.xpath.XPathExpressionException;
@@ -293,6 +294,11 @@ public final class CryptoCoverageUtil {
// XPathFactory and XPath are not thread-safe so we must recreate them
// each request.
final XPathFactory factory = XPathFactory.newInstance();
+ try {
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+ } catch (javax.xml.xpath.XPathFactoryConfigurationException ex) {
+ // ignore
+ }
final XPath xpath = factory.newXPath();
if (namespaces != null) {
diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AbstractBindingBuilder.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AbstractBindingBuilder.java
index b4a2d48..f754061 100644
--- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AbstractBindingBuilder.java
+++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyhandlers/AbstractBindingBuilder.java
@@ -36,6 +36,7 @@ import java.util.logging.Level;
import java.util.logging.Logger;
import javax.security.auth.callback.CallbackHandler;
+import javax.xml.XMLConstants;
import javax.xml.crypto.dsig.Reference;
import javax.xml.namespace.QName;
import javax.xml.soap.SOAPException;
@@ -1412,6 +1413,12 @@ public abstract class AbstractBindingBuilder extends AbstractCommonBindingHandle
);
XPathFactory factory = XPathFactory.newInstance();
+ try {
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+ } catch (javax.xml.xpath.XPathFactoryConfigurationException ex) {
+ // ignore
+ }
+
for (org.apache.wss4j.policy.model.XPath xPath : xpaths) {
XPath xpath = factory.newXPath();
if (xPath.getPrefixNamespaceMap() != null) {
diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/AbstractSupportingTokenPolicyValidator.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/AbstractSupportingTokenPolicyValidator.java
index 2bf0d89..7c81dc0 100644
--- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/AbstractSupportingTokenPolicyValidator.java
+++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/AbstractSupportingTokenPolicyValidator.java
@@ -29,6 +29,7 @@ import java.util.Map;
import java.util.logging.Level;
import java.util.logging.Logger;
+import javax.xml.XMLConstants;
import javax.xml.namespace.QName;
import javax.xml.soap.SOAPException;
import javax.xml.soap.SOAPMessage;
@@ -746,6 +747,12 @@ public abstract class AbstractSupportingTokenPolicyValidator extends AbstractSec
// XPathFactory and XPath are not thread-safe so we must recreate them
// each request.
final XPathFactory factory = XPathFactory.newInstance();
+ try {
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+ } catch (javax.xml.xpath.XPathFactoryConfigurationException ex) {
+ // ignore
+ }
+
final XPath xpath = factory.newXPath();
MapNamespaceContext namespaceContext = new MapNamespaceContext();
diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/RequiredElementsPolicyValidator.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/RequiredElementsPolicyValidator.java
index 0d200f8..c27367b 100644
--- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/RequiredElementsPolicyValidator.java
+++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/RequiredElementsPolicyValidator.java
@@ -22,6 +22,7 @@ package org.apache.cxf.ws.security.wss4j.policyvalidators;
import java.util.Collection;
import java.util.Map;
+import javax.xml.XMLConstants;
import javax.xml.xpath.XPath;
import javax.xml.xpath.XPathConstants;
import javax.xml.xpath.XPathExpressionException;
@@ -62,6 +63,12 @@ public class RequiredElementsPolicyValidator implements SecurityPolicyValidator
if (rp != null && rp.getXPaths() != null && !rp.getXPaths().isEmpty()) {
XPathFactory factory = XPathFactory.newInstance();
+ try {
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+ } catch (javax.xml.xpath.XPathFactoryConfigurationException ex) {
+ // ignore
+ }
+
for (org.apache.wss4j.policy.model.XPath xPath : rp.getXPaths()) {
Map<String, String> namespaces = xPath.getPrefixNamespaceMap();
String expression = xPath.getXPath();
diff --git a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/SecuredElementsPolicyValidator.java b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/SecuredElementsPolicyValidator.java
index d1ace10..e160f5d 100644
--- a/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/SecuredElementsPolicyValidator.java
+++ b/rt/ws/security/src/main/java/org/apache/cxf/ws/security/wss4j/policyvalidators/SecuredElementsPolicyValidator.java
@@ -25,6 +25,7 @@ import java.util.Collection;
import java.util.List;
import java.util.Map;
+import javax.xml.XMLConstants;
import javax.xml.xpath.XPath;
import javax.xml.xpath.XPathFactory;
@@ -77,6 +78,11 @@ public class SecuredElementsPolicyValidator implements SecurityPolicyValidator {
// XPathFactory and XPath are not thread-safe so we must recreate them
// each request.
final XPathFactory factory = XPathFactory.newInstance();
+ try {
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+ } catch (javax.xml.xpath.XPathFactoryConfigurationException ex) {
+ // ignore
+ }
final XPath xpath = factory.newXPath();
Element soapEnvelope =
diff --git a/rt/ws/transfer/src/main/java/org/apache/cxf/ws/transfer/dialect/fragment/language/FragmentDialectLanguageXPath10.java b/rt/ws/transfer/src/main/java/org/apache/cxf/ws/transfer/dialect/fragment/language/FragmentDialectLanguageXPath10.java
index 51c4da4..5050ef8 100644
--- a/rt/ws/transfer/src/main/java/org/apache/cxf/ws/transfer/dialect/fragment/language/FragmentDialectLanguageXPath10.java
+++ b/rt/ws/transfer/src/main/java/org/apache/cxf/ws/transfer/dialect/fragment/language/FragmentDialectLanguageXPath10.java
@@ -20,6 +20,7 @@ package org.apache.cxf.ws.transfer.dialect.fragment.language;
import java.util.Iterator;
+import javax.xml.XMLConstants;
import javax.xml.namespace.NamespaceContext;
import javax.xml.xpath.XPath;
import javax.xml.xpath.XPathConstants;
@@ -42,6 +43,14 @@ public class FragmentDialectLanguageXPath10 implements FragmentDialectLanguage {
private static XPathFactory xpathFactory = XPathFactory.newInstance();
+ static {
+ try {
+ xpathFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+ } catch (javax.xml.xpath.XPathFactoryConfigurationException ex) {
+ // ignore
+ }
+ }
+
@Override
public Object getResourceFragment(final Representation representation, ExpressionType expression) {
String expressionStr = getXPathFromExpression(expression);
diff --git a/testutils/src/main/java/org/apache/cxf/test/XPathAssert.java b/testutils/src/main/java/org/apache/cxf/test/XPathAssert.java
index 0cdd794..e66566e 100644
--- a/testutils/src/main/java/org/apache/cxf/test/XPathAssert.java
+++ b/testutils/src/main/java/org/apache/cxf/test/XPathAssert.java
@@ -23,6 +23,7 @@ import java.util.HashMap;
import java.util.Iterator;
import java.util.Map;
+import javax.xml.XMLConstants;
import javax.xml.namespace.NamespaceContext;
import javax.xml.namespace.QName;
import javax.xml.xpath.XPath;
@@ -206,7 +207,13 @@ public final class XPathAssert {
* addNamespace().
*/
public static XPath createXPath(Map<String, String> namespaces) throws Exception {
- XPath xpath = XPathFactory.newInstance().newXPath();
+ XPathFactory xpathFactory = XPathFactory.newInstance();
+ try {
+ xpathFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+ } catch (javax.xml.xpath.XPathFactoryConfigurationException ex) {
+ // ignore
+ }
+ XPath xpath = xpathFactory.newXPath();
if (namespaces != null) {
xpath.setNamespaceContext(new MapNamespaceContext(namespaces));
diff --git a/tools/wsdlto/databinding/jaxb/src/main/java/org/apache/cxf/tools/wsdlto/databinding/jaxb/JAXBDataBinding.java b/tools/wsdlto/databinding/jaxb/src/main/java/org/apache/cxf/tools/wsdlto/databinding/jaxb/JAXBDataBinding.java
index a610953..ccf4b12 100644
--- a/tools/wsdlto/databinding/jaxb/src/main/java/org/apache/cxf/tools/wsdlto/databinding/jaxb/JAXBDataBinding.java
+++ b/tools/wsdlto/databinding/jaxb/src/main/java/org/apache/cxf/tools/wsdlto/databinding/jaxb/JAXBDataBinding.java
@@ -553,7 +553,14 @@ public class JAXBDataBinding implements DataBindingProfile {
String s = r.getAttributeValue(null, "schemaLocation");
if (StringUtils.isEmpty(s)) {
Document d = StaxUtils.read(r);
- XPath p = XPathFactory.newInstance().newXPath();
+
+ XPathFactory xpathFactory = XPathFactory.newInstance();
+ try {
+ xpathFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+ } catch (javax.xml.xpath.XPathFactoryConfigurationException ex) {
+ // ignore
+ }
+ XPath p = xpathFactory.newXPath();
p.setNamespaceContext(new W3CNamespaceContext(d.getDocumentElement()));
XPathExpression xpe = p.compile(d.getDocumentElement().getAttribute("node"));
for (XmlSchema schema : schemas.getXmlSchemas()) {
diff --git a/tools/wsdlto/frontend/jaxws/src/main/java/org/apache/cxf/tools/wsdlto/frontend/jaxws/customization/JAXWSBindingParser.java b/tools/wsdlto/frontend/jaxws/src/main/java/org/apache/cxf/tools/wsdlto/frontend/jaxws/customization/JAXWSBindingParser.java
index 64201eb..1935b95 100644
--- a/tools/wsdlto/frontend/jaxws/src/main/java/org/apache/cxf/tools/wsdlto/frontend/jaxws/customization/JAXWSBindingParser.java
+++ b/tools/wsdlto/frontend/jaxws/src/main/java/org/apache/cxf/tools/wsdlto/frontend/jaxws/customization/JAXWSBindingParser.java
@@ -24,6 +24,7 @@ import java.util.logging.Logger;
import javax.wsdl.WSDLException;
import javax.wsdl.extensions.ExtensionRegistry;
+import javax.xml.XMLConstants;
import javax.xml.namespace.NamespaceContext;
import javax.xml.namespace.QName;
import javax.xml.xpath.XPath;
@@ -213,7 +214,14 @@ public class JAXWSBindingParser {
NodeList nlst;
try {
ContextImpl contextImpl = new ContextImpl(target);
- XPath xpath = XPathFactory.newInstance().newXPath();
+ XPathFactory xpathFactory = XPathFactory.newInstance();
+ try {
+ xpathFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+ } catch (javax.xml.xpath.XPathFactoryConfigurationException ex) {
+ // ignore
+ }
+
+ XPath xpath = xpathFactory.newXPath();
xpath.setNamespaceContext(contextImpl);
nlst = (NodeList)xpath.evaluate(expression, target, XPathConstants.NODESET);
} catch (XPathExpressionException e) {