Return-Path: X-Original-To: apmail-camel-commits-archive@www.apache.org Delivered-To: apmail-camel-commits-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 894E5102A3 for ; Mon, 2 Mar 2015 07:17:09 +0000 (UTC) Received: (qmail 80253 invoked by uid 500); 2 Mar 2015 07:17:09 -0000 Delivered-To: apmail-camel-commits-archive@camel.apache.org Received: (qmail 80100 invoked by uid 500); 2 Mar 2015 07:17:09 -0000 Mailing-List: contact commits-help@camel.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@camel.apache.org Delivered-To: mailing list commits@camel.apache.org Received: (qmail 79832 invoked by uid 99); 2 Mar 2015 07:17:09 -0000 Received: from git1-us-west.apache.org (HELO git1-us-west.apache.org) (140.211.11.23) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 02 Mar 2015 07:17:09 +0000 Received: by git1-us-west.apache.org (ASF Mail Server at git1-us-west.apache.org, from userid 33) id 026DDE07D9; Mon, 2 Mar 2015 07:17:08 +0000 (UTC) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: davsclaus@apache.org To: commits@camel.apache.org Date: Mon, 02 Mar 2015 07:17:09 -0000 Message-Id: In-Reply-To: <989a7e5f836d4fbcb23dfe836da10027@git.apache.org> References: <989a7e5f836d4fbcb23dfe836da10027@git.apache.org> X-Mailer: ASF-Git Admin Mailer Subject: [2/9] camel git commit: XML External Entity (XXE) injection in XmlConverter. Thanks to Stephan Siano for the patch. XML External Entity (XXE) injection in XmlConverter. Thanks to Stephan Siano for the patch. Project: http://git-wip-us.apache.org/repos/asf/camel/repo Commit: http://git-wip-us.apache.org/repos/asf/camel/commit/7d19340b Tree: http://git-wip-us.apache.org/repos/asf/camel/tree/7d19340b Diff: http://git-wip-us.apache.org/repos/asf/camel/diff/7d19340b Branch: refs/heads/master Commit: 7d19340bcdb42f7aae584d9c5003ac4f7ddaee36 Parents: 1df5596 Author: Claus Ibsen Authored: Sun Mar 1 11:52:57 2015 +0100 Committer: Claus Ibsen Committed: Mon Mar 2 08:15:45 2015 +0100 ---------------------------------------------------------------------- .../apache/camel/converter/jaxp/XmlConverter.java | 6 ++++++ .../apache/camel/component/xslt/XsltDTDTest.java | 16 +++++++++++----- 2 files changed, 17 insertions(+), 5 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/camel/blob/7d19340b/camel-core/src/main/java/org/apache/camel/converter/jaxp/XmlConverter.java ---------------------------------------------------------------------- diff --git a/camel-core/src/main/java/org/apache/camel/converter/jaxp/XmlConverter.java b/camel-core/src/main/java/org/apache/camel/converter/jaxp/XmlConverter.java index bad0e86..3079e7c 100644 --- a/camel-core/src/main/java/org/apache/camel/converter/jaxp/XmlConverter.java +++ b/camel-core/src/main/java/org/apache/camel/converter/jaxp/XmlConverter.java @@ -596,6 +596,12 @@ public class XmlConverter { } catch (Exception e) { LOG.warn("SAXParser doesn't support the feature {} with value {}, due to {}.", new Object[]{javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, "true", e}); } + try { + sfactory.setFeature("http://xml.org/sax/features/external-general-entities", false); + } catch (SAXException e) { + LOG.warn("SAXParser doesn't support the feature {} with value {}, due to {}." + , new Object[]{"http://xml.org/sax/features/external-general-entities", false, e}); + } } sfactory.setNamespaceAware(true); SAXParser parser = sfactory.newSAXParser(); http://git-wip-us.apache.org/repos/asf/camel/blob/7d19340b/camel-core/src/test/java/org/apache/camel/component/xslt/XsltDTDTest.java ---------------------------------------------------------------------- diff --git a/camel-core/src/test/java/org/apache/camel/component/xslt/XsltDTDTest.java b/camel-core/src/test/java/org/apache/camel/component/xslt/XsltDTDTest.java index db5d63c..c0d2723 100644 --- a/camel-core/src/test/java/org/apache/camel/component/xslt/XsltDTDTest.java +++ b/camel-core/src/test/java/org/apache/camel/component/xslt/XsltDTDTest.java @@ -57,19 +57,25 @@ public class XsltDTDTest extends ContextTestSupport { Exchange exchange = list.get(0); String xml = exchange.getIn().getBody(String.class); assertTrue("Get a wrong transformed message", xml.indexOf("") > 0); - - - + try { + endpoint.reset(); + endpoint.expectedMessageCount(1); + template.sendBody("direct:start2", message); - fail("Expect an exception here"); + + assertMockEndpointsSatisfied(); + + list = endpoint.getReceivedExchanges(); + exchange = list.get(0); + xml = exchange.getIn().getBody(String.class); + assertTrue("Get a wrong transformed message", xml.indexOf("") > 0); } catch (Exception ex) { // expect an exception here assertTrue("Get a wrong exception", ex instanceof CamelExecutionException); // the file could not be found assertTrue("Get a wrong exception cause", ex.getCause() instanceof TransformerException); } - }