You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@isis.apache.org by ah...@apache.org on 2020/10/18 08:00:54 UTC
[isis] branch master updated: ISIS-2297: vulnerability: Disable
access to external entities in XML parsing (sonar) (2)
This is an automated email from the ASF dual-hosted git repository.
ahuber pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/isis.git
The following commit(s) were added to refs/heads/master by this push:
new cbf14d6 ISIS-2297: vulnerability: Disable access to external entities in XML parsing (sonar) (2)
cbf14d6 is described below
commit cbf14d66d19b605945fde0f9ee574be8432a5ef1
Author: Andi Huber <ah...@apache.org>
AuthorDate: Sun Oct 18 09:52:39 2020 +0200
ISIS-2297: vulnerability: Disable access to external entities in XML
parsing (sonar) (2)
---
.../isis/commons/internal/codec/_DocumentFactories.java | 13 +++++++++----
.../org/apache/isis/commons/internal/resources/_Xml.java | 12 +++++++++---
2 files changed, 18 insertions(+), 7 deletions(-)
diff --git a/commons/src/main/java/org/apache/isis/commons/internal/codec/_DocumentFactories.java b/commons/src/main/java/org/apache/isis/commons/internal/codec/_DocumentFactories.java
index 705a321..32cae58 100644
--- a/commons/src/main/java/org/apache/isis/commons/internal/codec/_DocumentFactories.java
+++ b/commons/src/main/java/org/apache/isis/commons/internal/codec/_DocumentFactories.java
@@ -36,7 +36,8 @@ import lombok.experimental.UtilityClass;
* <p>
* <b>WARNING</b>: Do <b>NOT</b> use any of the classes provided by this package! <br/>
* These may be changed or removed without notice!
- * </p>
+ *
+ * @see https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
*
* @since 2.0
*/
@@ -67,10 +68,14 @@ public class _DocumentFactories {
public static XMLInputFactory xmlInputFactory() {
val xmlInputFactory = XMLInputFactory.newInstance();
- xmlInputFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, ""); // Disable access to external entities in XML parsing
- xmlInputFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); // Disable access to external entities in XML parsing
+
+ // disables DTDs entirely
+ xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+ // disable external entities
+ xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
+
return xmlInputFactory;
}
-
+
}
diff --git a/commons/src/main/java/org/apache/isis/commons/internal/resources/_Xml.java b/commons/src/main/java/org/apache/isis/commons/internal/resources/_Xml.java
index 8aa1e1d..93eb1ac 100644
--- a/commons/src/main/java/org/apache/isis/commons/internal/resources/_Xml.java
+++ b/commons/src/main/java/org/apache/isis/commons/internal/resources/_Xml.java
@@ -153,15 +153,15 @@ public final class _Xml {
}
- // --
+ // -- ENHANCE EXCEPTION MESSAGE IF POSSIBLE
public static Exception verboseException(String doingWhat, @Nullable Class<?> dtoClass, Exception e) {
val dtoClassName = Optional.ofNullable(dtoClass).map(Class::getName).orElse("unknown");
- if("com.sun.xml.bind.v2.runtime.IllegalAnnotationsException".equals(e.getClass().getName())) {
+ if(isIllegalAnnotationsException(e)) {
// report a better error if possible
- // this is done reflectively because on JDK 8 this is only provided by Oracle JDK
+ // this is done reflectively because on JDK 8 this exception type is only provided by Oracle JDK
try {
val errors = _Casts.<List<? extends Exception>>uncheckedCast(
@@ -190,6 +190,12 @@ public final class _Xml {
+ "object class is '%s'", doingWhat, dtoClassName), e);
}
+ private static boolean isIllegalAnnotationsException(Exception e) {
+ /*sonar-ignore-on*/
+ return "com.sun.xml.bind.v2.runtime.IllegalAnnotationsException".equals(e.getClass().getName());
+ /*sonar-ignore-off*/
+ }
+
// -- JAXB CONTEXT CACHE
private static Map<Class<?>, JAXBContext> jaxbContextByClass = _Maps.newConcurrentHashMap();