Nexory opened a new pull request, #1537:
URL: https://github.com/apache/wicket/pull/1537
## What
`XsltTransformer.transform()` builds its `TransformerFactory` with a plain
`TransformerFactory.newInstance()` and then transforms the decorated
component's rendered output as the XML source document. That source is
attacker-influenceable (it is whatever the component rendered, including user
model data), so an external entity in it is resolved: a crafted document can
read local files or reach internal URLs (XXE).
`XSLTResourceStream` (wicket-util) already hardens its factory with
`FEATURE_SECURE_PROCESSING` (PR #862), but the other XSLT entry point,
`XsltTransformer`, was left untouched. A grep for `FEATURE_SECURE_PROCESSING`
returns only that one site.
## Fix
Enable `FEATURE_SECURE_PROCESSING` on the factory, mirroring
`XSLTResourceStream`. On the JDK this also denies external DTD and stylesheet
access, so the external entity is rejected instead of resolved. No change for
legitimate stylesheet transforms.
## Verification
- Standalone under JDK 21: with a plain factory an external general entity in
the source document leaks a local file's contents into the transform
output;
with `FEATURE_SECURE_PROCESSING` set the parse is rejected (the
`accessExternalDTD` restriction denies the `file` access).
- The existing `OutputTransformerContainer` and transformer tests still pass,
so legitimate stylesheet transforms are unaffected.
This is defense-in-depth hardening, mirroring the existing
`XSLTResourceStream`
change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
