You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@lucene.apache.org by us...@apache.org on 2018/03/01 18:29:47 UTC
lucene-solr:branch_6_6: SOLR-11971: Don't allow referal to external
resources in DataImportHandler's dataConfig request parameter
Repository: lucene-solr
Updated Branches:
refs/heads/branch_6_6 51e712c06 -> dd3be31f7
SOLR-11971: Don't allow referal to external resources in DataImportHandler's dataConfig request parameter
Project: http://git-wip-us.apache.org/repos/asf/lucene-solr/repo
Commit: http://git-wip-us.apache.org/repos/asf/lucene-solr/commit/dd3be31f
Tree: http://git-wip-us.apache.org/repos/asf/lucene-solr/tree/dd3be31f
Diff: http://git-wip-us.apache.org/repos/asf/lucene-solr/diff/dd3be31f
Branch: refs/heads/branch_6_6
Commit: dd3be31f7062dcb2f3b2d7f0e89df29e197dee63
Parents: 51e712c
Author: Uwe Schindler <us...@apache.org>
Authored: Sun Feb 18 22:41:06 2018 +0100
Committer: Uwe Schindler <us...@apache.org>
Committed: Thu Mar 1 19:25:50 2018 +0100
----------------------------------------------------------------------
solr/CHANGES.txt | 6 ++++--
.../solr/handler/dataimport/DataImporter.java | 17 +++++++++++++----
.../handler/dataimport/TestErrorHandling.java | 20 ++++++++++++++++++++
3 files changed, 37 insertions(+), 6 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/lucene-solr/blob/dd3be31f/solr/CHANGES.txt
----------------------------------------------------------------------
diff --git a/solr/CHANGES.txt b/solr/CHANGES.txt
index 6cef677..1dda7a3 100644
--- a/solr/CHANGES.txt
+++ b/solr/CHANGES.txt
@@ -29,9 +29,11 @@ Apache UIMA 2.3.1
Apache ZooKeeper 3.4.10
Jetty 9.3.14.v20161028
+Bug Fixes
+----------------------
-(No Changes)
-
+* SOLR-11971: Don't allow referal to external resources in DataImportHandler's dataConfig request parameter.
+ (麦 香浓郁, Uwe Schindler)
================== 6.6.2 ==================
http://git-wip-us.apache.org/repos/asf/lucene-solr/blob/dd3be31f/solr/contrib/dataimporthandler/src/java/org/apache/solr/handler/dataimport/DataImporter.java
----------------------------------------------------------------------
diff --git a/solr/contrib/dataimporthandler/src/java/org/apache/solr/handler/dataimport/DataImporter.java b/solr/contrib/dataimporthandler/src/java/org/apache/solr/handler/dataimport/DataImporter.java
index a49b4f6..4825fd1 100644
--- a/solr/contrib/dataimporthandler/src/java/org/apache/solr/handler/dataimport/DataImporter.java
+++ b/solr/contrib/dataimporthandler/src/java/org/apache/solr/handler/dataimport/DataImporter.java
@@ -16,6 +16,7 @@
*/
package org.apache.solr.handler.dataimport;
+import org.apache.solr.common.EmptyEntityResolver;
import org.apache.solr.common.SolrException;
import org.apache.solr.core.SolrCore;
import org.apache.solr.schema.IndexSchema;
@@ -178,11 +179,11 @@ public class DataImporter {
/**
* Used by tests
*/
- public void loadAndInit(String configStr) {
+ void loadAndInit(String configStr) {
config = loadDataConfig(new InputSource(new StringReader(configStr)));
}
- public void loadAndInit(InputSource configFile) {
+ void loadAndInit(InputSource configFile) {
config = loadDataConfig(configFile);
}
@@ -191,8 +192,10 @@ public class DataImporter {
DIHConfiguration dihcfg = null;
try {
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+ dbf.setValidating(false);
- // only enable xinclude, if a a SolrCore and SystemId is present (makes no sense otherwise)
+ // only enable xinclude, if XML is coming from safe source (local file)
+ // and a a SolrCore and SystemId is present (makes no sense otherwise):
if (core != null && configFile.getSystemId() != null) {
try {
dbf.setXIncludeAware(true);
@@ -203,8 +206,14 @@ public class DataImporter {
}
DocumentBuilder builder = dbf.newDocumentBuilder();
- if (core != null)
+ // only enable xinclude / external entities, if XML is coming from
+ // safe source (local file) and a a SolrCore and SystemId is present:
+ if (core != null && configFile.getSystemId() != null) {
builder.setEntityResolver(new SystemIdResolver(core.getResourceLoader()));
+ } else {
+ // Don't allow external entities without having a system ID:
+ builder.setEntityResolver(EmptyEntityResolver.SAX_INSTANCE);
+ }
builder.setErrorHandler(XMLLOG);
Document document;
try {
http://git-wip-us.apache.org/repos/asf/lucene-solr/blob/dd3be31f/solr/contrib/dataimporthandler/src/test/org/apache/solr/handler/dataimport/TestErrorHandling.java
----------------------------------------------------------------------
diff --git a/solr/contrib/dataimporthandler/src/test/org/apache/solr/handler/dataimport/TestErrorHandling.java b/solr/contrib/dataimporthandler/src/test/org/apache/solr/handler/dataimport/TestErrorHandling.java
index 74eaf9e..1ea1ad4 100644
--- a/solr/contrib/dataimporthandler/src/test/org/apache/solr/handler/dataimport/TestErrorHandling.java
+++ b/solr/contrib/dataimporthandler/src/test/org/apache/solr/handler/dataimport/TestErrorHandling.java
@@ -89,6 +89,13 @@ public class TestErrorHandling extends AbstractDataImportHandlerTestCase {
assertQ(req("*:*"), "//*[@numFound='3']");
}
+ public void testExternalEntity() throws Exception {
+ StringDataSource.xml = wellformedXml;
+ // This should not fail as external entities are replaced by an empty string during parsing:
+ runFullImport(dataConfigWithEntity);
+ assertQ(req("*:*"), "//*[@numFound='3']");
+ }
+
public static class StringDataSource extends DataSource<Reader> {
public static String xml = "";
@@ -157,6 +164,19 @@ public class TestErrorHandling extends AbstractDataImportHandlerTestCase {
" </document>\n" +
"</dataConfig>";
+ private String dataConfigWithEntity = "<!DOCTYPE dataConfig [\n" +
+ " <!ENTITY internalTerm \"node\">\n" +
+ " <!ENTITY externalTerm SYSTEM \"foo://bar.xyz/external\">\n" +
+ "]><dataConfig>\n" +
+ " <dataSource name=\"str\" type=\"TestErrorHandling$StringDataSource\" />" +
+ " <document>\n" +
+ " <entity name=\"&internalTerm;\" dataSource=\"str\" processor=\"XPathEntityProcessor\" url=\"test\" forEach=\"/root/node\" onError=\"skip\">\n" +
+ " <field column=\"id\" xpath=\"/root/node/id\">&externalTerm;</field>\n" +
+ " <field column=\"desc\" xpath=\"/root/node/desc\" />\n" +
+ " </entity>\n" +
+ " </document>\n" +
+ "</dataConfig>";
+
private String malformedXml = "<root>\n" +
" <node>\n" +
" <id>1</id>\n" +