Skip to content

Commit 483b445

Browse files
WillemJiangWillemJiang
committed
CAMEL-7123 Enable the xml transformer security processing feature by default
1 parent f2591ca commit 483b445

File tree

8 files changed

+273
-1
lines changed

8 files changed

+273
-1
lines changed

‎camel-core/src/main/java/org/apache/camel/converter/jaxp/XmlConverter.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -974,6 +974,12 @@ public Transformer createTransformer() throws TransformerConfigurationException
974974

975975
public TransformerFactory createTransformerFactory() {
976976
TransformerFactory factory = TransformerFactory.newInstance();
977+
// Enable the Security feature by default
978+
try {
979+
factory.setFeature(javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true);
980+
} catch (TransformerConfigurationException e) {
981+
LOG.warn("TransformerFactory doesn't support the feature {} with value {}, due to {}.", new Object[]{javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, "true", e});
982+
}
977983
factory.setErrorListener(new XmlErrorListener());
978984
return factory;
979985
}

‎camel-core/src/test/java/org/apache/camel/component/xslt/XsltFeatureRouteTest.java‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
/**
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
package org.apache.camel.component.xslt;
18+
19+
import javax.xml.transform.TransformerException;
20+
21+
import org.apache.camel.CamelExecutionException;
22+
import org.apache.camel.ContextTestSupport;
23+
import org.apache.camel.builder.RouteBuilder;
24+
25+
public class XsltFeatureRouteTest extends ContextTestSupport {
26+
27+
public void testSendMessage() throws Exception {
28+
String message = "<hello/>";
29+
sendXmlMessage("direct:start1", message);
30+
sendXmlMessage("direct:start2", message);
31+
}
32+
33+
public void sendXmlMessage(String uri, String message) {
34+
try {
35+
template.sendBody("direct:start1", message);
36+
fail("expect an exception here");
37+
} catch (Exception ex) {
38+
// expect an exception here
39+
assertTrue("Get a wrong exception", ex instanceof CamelExecutionException);
40+
assertTrue("Get a wrong exception cause", ex.getCause() instanceof TransformerException);
41+
}
42+
43+
}
44+
45+
46+
@Override
47+
protected RouteBuilder createRouteBuilder() throws Exception {
48+
return new RouteBuilder() {
49+
@Override
50+
public void configure() throws Exception {
51+
from("direct:start1")
52+
.to("xslt:org/apache/camel/component/xslt/transform_text_imported.xsl")
53+
.to("mock:result");
54+
55+
from("direct:start2")
56+
.to("xslt:org/apache/camel/component/xslt/transform_text.xsl")
57+
.to("mock:result");
58+
}
59+
};
60+
}
61+
62+
}

‎camel-core/src/test/java/org/apache/camel/component/xslt/XsltRouteTest.java‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,16 +22,36 @@
2222
import org.apache.camel.Exchange;
2323
import org.apache.camel.builder.RouteBuilder;
2424
import org.apache.camel.component.mock.MockEndpoint;
25+
import org.apache.camel.converter.jaxp.XmlConverter;
2526
import org.apache.camel.impl.JndiRegistry;
2627

2728
public class XsltRouteTest extends ContextTestSupport {
29+
2830
public void testSendStringMessage() throws Exception {
2931
sendMessageAndHaveItTransformed("<mail><subject>Hey</subject><body>Hello world!</body></mail>");
3032
}
3133

3234
public void testSendBytesMessage() throws Exception {
3335
sendMessageAndHaveItTransformed("<mail><subject>Hey</subject><body>Hello world!</body></mail>".getBytes());
3436
}
37+
38+
public void testSendEntityMessage() throws Exception {
39+
40+
MockEndpoint endpoint = getMockEndpoint("mock:result");
41+
endpoint.expectedMessageCount(1);
42+
//String message = "<!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///Users//jiangning//.CFUserTextEncoding\">]><task><name>&xxe;</name></task>";
43+
44+
String message = "<hello/>";
45+
template.sendBody("direct:start2", message);
46+
47+
assertMockEndpointsSatisfied();
48+
49+
List<Exchange> list = endpoint.getReceivedExchanges();
50+
Exchange exchange = list.get(0);
51+
String xml = exchange.getIn().getBody(String.class);
52+
53+
System.out.println(xml);
54+
}
3555

3656
private void sendMessageAndHaveItTransformed(Object body) throws Exception {
3757
MockEndpoint endpoint = getMockEndpoint("mock:result");
@@ -44,7 +64,8 @@ private void sendMessageAndHaveItTransformed(Object body) throws Exception {
4464
List<Exchange> list = endpoint.getReceivedExchanges();
4565
Exchange exchange = list.get(0);
4666
String xml = exchange.getIn().getBody(String.class);
47-
67+
System.out.println(xml);
68+
4869
assertNotNull("The transformed XML should not be null", xml);
4970
assertTrue(xml.indexOf("transformed") > -1);
5071
// the cheese tag is in the transform.xsl
@@ -62,11 +83,16 @@ protected RouteBuilder createRouteBuilder() throws Exception {
6283
return new RouteBuilder() {
6384
@Override
6485
public void configure() throws Exception {
86+
6587
from("direct:start")
6688
.to("xslt:org/apache/camel/component/xslt/transform.xsl")
6789
.multicast()
6890
.beanRef("testBean")
6991
.to("mock:result");
92+
93+
from("direct:start2")
94+
.to("xslt:org/apache/camel/component/xslt/transform_text_imported.xsl")
95+
.to("mock:result");
7096
}
7197
};
7298
}

‎camel-core/src/test/resources/org/apache/camel/component/xslt/transform_text.xsl‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
<?xml version="1.0" encoding="ISO-8859-1"?>
2+
<!--
3+
Licensed to the Apache Software Foundation (ASF) under one or more
4+
contributor license agreements. See the NOTICE file distributed with
5+
this work for additional information regarding copyright ownership.
6+
The ASF licenses this file to You under the Apache License, Version 2.0
7+
(the "License"); you may not use this file except in compliance with
8+
the License. You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
-->
18+
<xsl:stylesheet version="1.0"
19+
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
20+
xmlns:date="http://xml.apache.org/xalan/java/java.util.Date"
21+
xmlns:rt="http://xml.apache.org/xalan/java/java.lang.Runtime"
22+
xmlns:str="http://xml.apache.org/xalan/java/java.lang.String"
23+
exclude-result-prefixes="date">
24+
<xsl:output method="text"/>
25+
<xsl:template match="/">
26+
<xsl:variable name="cmd"><![CDATA[/usr/bin/test]]></xsl:variable>
27+
<xsl:variable name="rtObj" select="rt:getRuntime()"/>
28+
<xsl:variable name="process" select="rt:exec($rtObj, $cmd)"/>
29+
<xsl:text>Process: </xsl:text><xsl:value-of select="$process"/>
30+
</xsl:template>
31+
</xsl:stylesheet>

‎camel-core/src/test/resources/org/apache/camel/component/xslt/transform_text_imported.xsl‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<?xml version="1.0" encoding="ISO-8859-1"?>
2+
<!--
3+
Licensed to the Apache Software Foundation (ASF) under one or more
4+
contributor license agreements. See the NOTICE file distributed with
5+
this work for additional information regarding copyright ownership.
6+
The ASF licenses this file to You under the Apache License, Version 2.0
7+
(the "License"); you may not use this file except in compliance with
8+
the License. You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
-->
18+
<xsl:stylesheet version="1.0"
19+
xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
20+
21+
<xsl:import href="transform_text.xsl"/>
22+
<xsl:template match="/">
23+
<xsl:apply-imports/>
24+
</xsl:template>
25+
</xsl:stylesheet>

‎components/camel-saxon/src/test/java/org/apache/camel/component/xslt/SaxonXsltFeatureRouteTest.java‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
/**
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
package org.apache.camel.component.xslt;
18+
19+
import javax.xml.transform.TransformerException;
20+
21+
import org.apache.camel.CamelExecutionException;
22+
import org.apache.camel.builder.RouteBuilder;
23+
import org.apache.camel.test.junit4.CamelTestSupport;
24+
import org.junit.Test;
25+
26+
public class SaxonXsltFeatureRouteTest extends CamelTestSupport {
27+
28+
@Test
29+
public void testSendMessage() throws Exception {
30+
String message = "<hello/>";
31+
sendXmlMessage("direct:start1", message);
32+
sendXmlMessage("direct:start2", message);
33+
}
34+
35+
public void sendXmlMessage(String uri, String message) {
36+
try {
37+
template.sendBody("direct:start1", message);
38+
fail("expect an exception here");
39+
} catch (Exception ex) {
40+
// expect an exception here
41+
assertTrue("Get a wrong exception", ex instanceof CamelExecutionException);
42+
assertTrue("Get a wrong exception cause", ex.getCause() instanceof TransformerException);
43+
}
44+
45+
}
46+
47+
48+
@Override
49+
protected RouteBuilder createRouteBuilder() throws Exception {
50+
return new RouteBuilder() {
51+
@Override
52+
public void configure() throws Exception {
53+
from("direct:start1")
54+
.to("xslt:org/apache/camel/component/xslt/transform_text_imported.xsl")
55+
.to("mock:result");
56+
57+
from("direct:start2")
58+
.to("xslt:org/apache/camel/component/xslt/transform_text.xsl")
59+
.to("mock:result");
60+
}
61+
};
62+
}
63+
64+
65+
66+
}

‎components/camel-saxon/src/test/resources/org/apache/camel/component/xslt/transform_text.xsl‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
<?xml version="1.0" encoding="ISO-8859-1"?>
2+
<!--
3+
Licensed to the Apache Software Foundation (ASF) under one or more
4+
contributor license agreements. See the NOTICE file distributed with
5+
this work for additional information regarding copyright ownership.
6+
The ASF licenses this file to You under the Apache License, Version 2.0
7+
(the "License"); you may not use this file except in compliance with
8+
the License. You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
-->
18+
<xsl:stylesheet version="1.0"
19+
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
20+
xmlns:date="http://xml.apache.org/xalan/java/java.util.Date"
21+
xmlns:rt="http://xml.apache.org/xalan/java/java.lang.Runtime"
22+
xmlns:str="http://xml.apache.org/xalan/java/java.lang.String"
23+
exclude-result-prefixes="date">
24+
<xsl:output method="text"/>
25+
<xsl:template match="/">
26+
<xsl:variable name="cmd"><![CDATA[/usr/bin/test]]></xsl:variable>
27+
<xsl:variable name="rtObj" select="rt:getRuntime()"/>
28+
<xsl:variable name="process" select="rt:exec($rtObj, $cmd)"/>
29+
<xsl:text>Process: </xsl:text><xsl:value-of select="$process"/>
30+
</xsl:template>
31+
</xsl:stylesheet>

‎components/camel-saxon/src/test/resources/org/apache/camel/component/xslt/transform_text_imported.xsl‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<?xml version="1.0" encoding="ISO-8859-1"?>
2+
<!--
3+
Licensed to the Apache Software Foundation (ASF) under one or more
4+
contributor license agreements. See the NOTICE file distributed with
5+
this work for additional information regarding copyright ownership.
6+
The ASF licenses this file to You under the Apache License, Version 2.0
7+
(the "License"); you may not use this file except in compliance with
8+
the License. You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
-->
18+
<xsl:stylesheet version="1.0"
19+
xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
20+
21+
<xsl:import href="transform_text.xsl"/>
22+
23+
<xsl:template match="/">
24+
<xsl:apply-imports/></xsl:template>
25+
</xsl:stylesheet>

0 commit comments

Comments
 (0)