Skip to content

Create class SecureXML for creating safe document builder #1594

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MaximPlusov wants to merge 1 commit into
base: integration
Choose a base branch
from
Open

Create class SecureXML for creating safe document builder #1594

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 2 additions & 10 deletions core/src/main/java/org/verapdf/metadata/fixer/utils/parser/XMLProcessedObjectsParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
import org.verapdf.metadata.fixer.utils.model.ProcessedObjects;
import org.verapdf.metadata.fixer.utils.model.RuleDescription;
import org.verapdf.pdfa.flavours.PDFAFlavour;
import org.verapdf.xmp.tools.SecureXML;
import org.w3c.dom.Document;
import org.w3c.dom.Node;
import org.w3c.dom.NodeList;
Expand Down Expand Up @@ -86,16 +87,7 @@ public ProcessedObjects getProcessedObjects(String path)
@Override
public ProcessedObjects getProcessedObjects(InputStream xml)
throws ParserConfigurationException, IOException, SAXException {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
try {
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
} catch (Exception e) {
LOGGER.log(Level.WARNING, "Unable to secure xml processing");
}
DocumentBuilder builder = factory.newDocumentBuilder();

factory.setIgnoringElementContentWhitespace(true);

DocumentBuilder builder = SecureXML.newSafeDocumentBuilder();
Document doc = builder.parse(xml);

Node root = doc.getDocumentElement();
Expand Down
10 changes: 2 additions & 8 deletions core/src/main/java/org/verapdf/report/XmpHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@
package org.verapdf.report;

import org.verapdf.features.tools.FeatureTreeNode;
import org.verapdf.xmp.tools.SecureXML;
import org.w3c.dom.Document;
import org.w3c.dom.Node;
import org.xml.sax.InputSource;
Expand Down Expand Up @@ -137,14 +138,7 @@ public static Node parseMetadataRootElement(FeatureTreeNode metadataNode)
if (is == null) {
return null;
}
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
try {
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
} catch (Exception e) {
LOGGER.log(Level.WARNING, "Unable to secure metadata processing");
}
factory.setNamespaceAware(true);
DocumentBuilder builder = factory.newDocumentBuilder();
DocumentBuilder builder = SecureXML.newSafeDocumentBuilder();
Document metadataDocument = builder.parse(is);
return metadataDocument.getDocumentElement();
}
Expand Down
32 changes: 2 additions & 30 deletions xmp-core/src/main/java/org/verapdf/xmp/impl/XMPMetaParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,10 @@
import java.io.StringReader;
import java.io.UnsupportedEncodingException;

import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;

import org.verapdf.xmp.tools.SecureXML;
import org.w3c.dom.Document;
import org.w3c.dom.Node;
import org.w3c.dom.NodeList;
Expand All @@ -47,7 +46,6 @@ public class XMPMetaParser
/** */
private static final Object XMP_RDF = new Object();
/** the DOM Parser Factory, options are set */
private static DocumentBuilderFactory factory = createDocumentBuilderFactory();
//------------------------------------------------------------------------------ veraPDF: additional field for actual encoding used for XMP package serialization
private String actualEncoding;

Expand Down Expand Up @@ -280,8 +278,7 @@ private Document parseInputSource(InputSource source) throws XMPException
{
try
{
DocumentBuilder builder = factory.newDocumentBuilder();
builder.setErrorHandler(null);
DocumentBuilder builder = SecureXML.newSafeDocumentBuilder();
return builder.parse(source);
}
catch (SAXException e)
Expand Down Expand Up @@ -395,29 +392,4 @@ else if (!xmpmetaRequired &&
return null;
// is extracted here in the C++ Toolkit
}


/**
* @return Creates, configures and returnes the document builder factory for
* the Metadata Parser.
*/
private static DocumentBuilderFactory createDocumentBuilderFactory()
{
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setNamespaceAware(true);
factory.setIgnoringComments(true);

try
{
// honor System parsing limits, e.g.
// System.setProperty("entityExpansionLimit", "10");
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
}
catch (Exception e)
{
// Ignore IllegalArgumentException and ParserConfigurationException
// in case the configured XML-Parser does not implement the feature.
}
return factory;
}
}
47 changes: 47 additions & 0 deletions xmp-core/src/main/java/org/verapdf/xmp/tools/SecureXML.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
package org.verapdf.xmp.tools;

import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;

public class SecureXML {

private static DocumentBuilderFactory factory = createDocumentBuilderFactory();

public static DocumentBuilder newSafeDocumentBuilder() throws ParserConfigurationException {
DocumentBuilder builder = factory.newDocumentBuilder();
builder.setErrorHandler(null);
return builder;
}

/**
* @return Creates, configures and returns the document builder factory for
* the Metadata Parser.
*/
private static DocumentBuilderFactory createDocumentBuilderFactory()
{
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setNamespaceAware(true);
factory.setIgnoringComments(true);
try
{
// honor System parsing limits, e.g.
// System.setProperty("entityExpansionLimit", "10");
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("[http://apache.org/xml/features/disallow-doctype-decl](http://apache.org/xml/features/disallow-doctype-decl)", true);
factory.setFeature("[http://xml.org/sax/features/external-general-entities](http://xml.org/sax/features/external-general-entities)", false);
factory.setFeature("[http://xml.org/sax/features/external-parameter-entities](http://xml.org/sax/features/external-parameter-entities)", false);
factory.setFeature("[http://apache.org/xml/features/nonvalidating/load-external-dtd](http://apache.org/xml/features/nonvalidating/load-external-dtd)", false);
factory.setXIncludeAware(false);
factory.setExpandEntityReferences(false);
factory.setIgnoringElementContentWhitespace(true);
}
catch (Exception e)
{
// Ignore IllegalArgumentException and ParserConfigurationException
// in case the configured XML-Parser does not implement the feature.
}
return factory;
}
}
Loading