This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3_0_x-fixes
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
The following commit(s) were added to refs/heads/3_0_x-fixes by this push:
new a433941ae Harden XML parsing via commons-secure-xml (#673)
a433941ae is described below
commit a433941aef3d3b711b6dc2b9905091658fffd282
Author: Gary Gregory <[email protected]>
AuthorDate: Mon Sep 14 06:33:25 2026 -0700
Harden XML parsing via commons-secure-xml (#673)
* Harden XML parsing via commons-secure-xml
This reuses Apache Commons Secure XML.
* Update
integration/src/test/java/org/apache/wss4j/integration/test/kerberos/KerberosTest.java
Co-authored-by: Piotr P. Karwasz <[email protected]>
* Harden XML parsing via commons-secure-xml
Remove now redundant code.
* Use newNSInstance().
* Harden XML parsing via commons-secure-xml
* Sentence starts with a capital letter.
---------
Co-authored-by: Piotr P. Karwasz <[email protected]>
---
integration/pom.xml | 4 ++
.../integration/test/kerberos/KerberosTest.java | 10 +++--
parent/pom.xml | 5 +++
ws-security-common/pom.xml | 4 ++
.../org/apache/wss4j/common/util/XMLUtils.java | 15 ++-----
.../org/apache/wss4j/common/util/SOAPUtil.java | 8 ++--
.../dom/common/AbstractSAMLCallbackHandler.java | 4 +-
.../dom/common/SAMLElementCallbackHandler.java | 3 +-
.../dom/components/crypto/CryptoProviderTest.java | 7 ++--
.../apache/wss4j/dom/handler/CustomTokenTest.java | 4 +-
.../wss4j/dom/message/SignaturePrefixListTest.java | 4 +-
.../apache/wss4j/dom/message/SignatureTest.java | 4 +-
.../dom/message/token/DerivedKeyTokenTest.java | 6 +--
.../wss4j/dom/message/token/ReferenceTest.java | 4 +-
.../org/apache/wss4j/dom/saml/SamlTokenTest.java | 7 ++--
.../wss4j/dom/saml/SignedSamlTokenHOKTest.java | 4 +-
.../wss4j/dom/saml/ext/AssertionSigningTest.java | 4 +-
.../policy/stax/test/AbstractPolicyTestBase.java | 4 +-
.../test/AsymmetricBindingIntegrationTest.java | 48 +++++++++++-----------
.../stax/test/TransportBindingIntegrationTest.java | 26 ++++++------
.../apache/wss4j/stax/ext/DocumentCreatorImpl.java | 8 ++--
.../org/apache/wss4j/stax/setup/InboundWSSec.java | 3 +-
.../java/org/apache/wss4j/stax/setup/WSSec.java | 4 +-
.../apache/wss4j/stax/test/AbstractTestBase.java | 14 ++++---
.../apache/wss4j/stax/test/EncDecryptionTest.java | 3 +-
.../java/org/apache/wss4j/stax/test/FaultTest.java | 4 +-
.../stax/test/saml/SAMLCallbackHandlerImpl.java | 4 +-
27 files changed, 113 insertions(+), 102 deletions(-)
diff --git a/integration/pom.xml b/integration/pom.xml
index 425bcf1fe..28b533121 100644
--- a/integration/pom.xml
+++ b/integration/pom.xml
@@ -45,6 +45,10 @@
</build>
<dependencies>
+ <dependency>
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-secure-xml</artifactId>
+ </dependency>
<dependency>
<groupId>org.apache.wss4j</groupId>
<artifactId>wss4j-ws-security-common</artifactId>
diff --git
a/integration/src/test/java/org/apache/wss4j/integration/test/kerberos/KerberosTest.java
b/integration/src/test/java/org/apache/wss4j/integration/test/kerberos/KerberosTest.java
index 13d98a83d..21ad6d548 100644
---
a/integration/src/test/java/org/apache/wss4j/integration/test/kerberos/KerberosTest.java
+++
b/integration/src/test/java/org/apache/wss4j/integration/test/kerberos/KerberosTest.java
@@ -42,6 +42,9 @@ import javax.xml.transform.TransformerFactory;
import javax.xml.transform.dom.DOMSource;
import javax.xml.transform.stream.StreamResult;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
+import org.apache.commons.xml.secure.SecureTransformerFactory;
+import org.apache.commons.xml.secure.SecureXMLInputFactory;
import org.apache.kerby.kerberos.kerb.server.SimpleKdcServer;
import org.apache.wss4j.common.ext.WSSecurityException;
import org.apache.wss4j.common.kerberos.KerberosContextAndServiceNameCallback;
@@ -90,8 +93,8 @@ public class KerberosTest {
private static final org.slf4j.Logger LOG =
org.slf4j.LoggerFactory.getLogger(KerberosTest.class);
- private static final XMLInputFactory xmlInputFactory =
XMLInputFactory.newInstance();
- private static final TransformerFactory TRANSFORMER_FACTORY =
TransformerFactory.newInstance();
+ private static final XMLInputFactory xmlInputFactory =
SecureXMLInputFactory.newInstance();
+ private static final TransformerFactory TRANSFORMER_FACTORY =
SecureTransformerFactory.newInstance();
private static DocumentBuilderFactory dbf;
private static boolean runTests = true;
@@ -135,8 +138,7 @@ public class KerberosTest {
runTests = false;
}
- dbf = DocumentBuilderFactory.newInstance();
- dbf.setNamespaceAware(true);
+ dbf = SecureDocumentBuilderFactory.newNSInstance();
dbf.setIgnoringComments(false);
dbf.setCoalescing(false);
dbf.setIgnoringElementContentWhitespace(false);
diff --git a/parent/pom.xml b/parent/pom.xml
index 8c7731bba..31eff9069 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -190,6 +190,11 @@
</exclusion>
</exclusions>
</dependency>
+ <dependency>
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-secure-xml</artifactId>
+ <version>1.0.0</version>
+ </dependency>
</dependencies>
</dependencyManagement>
diff --git a/ws-security-common/pom.xml b/ws-security-common/pom.xml
index 94fe718ec..895cd4a65 100644
--- a/ws-security-common/pom.xml
+++ b/ws-security-common/pom.xml
@@ -204,6 +204,10 @@
<version>${opensaml.version}</version>
<scope>compile</scope>
</dependency>
+ <dependency>
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-secure-xml</artifactId>
+ </dependency>
<dependency>
<groupId>org.ehcache</groupId>
<artifactId>ehcache</artifactId>
diff --git
a/ws-security-common/src/main/java/org/apache/wss4j/common/util/XMLUtils.java
b/ws-security-common/src/main/java/org/apache/wss4j/common/util/XMLUtils.java
index 136b18410..33e7f5ed1 100644
---
a/ws-security-common/src/main/java/org/apache/wss4j/common/util/XMLUtils.java
+++
b/ws-security-common/src/main/java/org/apache/wss4j/common/util/XMLUtils.java
@@ -27,7 +27,6 @@ import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
-import javax.xml.XMLConstants;
import javax.xml.transform.Source;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerException;
@@ -44,8 +43,11 @@ import org.w3c.dom.Element;
import org.w3c.dom.NamedNodeMap;
import org.w3c.dom.Node;
import org.w3c.dom.Text;
+
import org.xml.sax.InputSource;
+import org.apache.commons.xml.secure.SecureTransformerFactory;
+
public final class XMLUtils {
public static final String XMLNS_NS = "http://www.w3.org/2000/xmlns/";;
@@ -139,16 +141,7 @@ public final class XMLUtils {
throws TransformerException {
DOMSource source = new DOMSource(element);
StreamResult result = new StreamResult(out);
-
- TransformerFactory transFactory = TransformerFactory.newInstance();
- transFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
- try {
- transFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
- transFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET,
"");
- } catch (IllegalArgumentException ex) { //NOPMD
- // ignore
- }
-
+ TransformerFactory transFactory =
SecureTransformerFactory.newInstance();
Transformer transformer = transFactory.newTransformer();
transformer.transform(source, result);
}
diff --git
a/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java
b/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java
index b63cd2c91..68140aa3c 100644
---
a/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java
+++
b/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java
@@ -21,7 +21,10 @@ package org.apache.wss4j.common.util;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
+
import jakarta.xml.soap.MessageFactory;
+
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
import java.io.ByteArrayInputStream;
import java.io.InputStream;
@@ -41,15 +44,14 @@ public class SOAPUtil {
private static final org.slf4j.Logger LOG =
org.slf4j.LoggerFactory.getLogger(SOAPUtil.class);
- private static DocumentBuilderFactory factory =
DocumentBuilderFactory.newInstance();
+ private static DocumentBuilderFactory factory =
SecureDocumentBuilderFactory.newNSInstance();
private static MessageFactory saajFactory = null;
static {
- factory.setNamespaceAware(true);
try {
saajFactory = MessageFactory.newInstance();
} catch (Exception e) {
- LOG.debug("can't create SAAJ MessageFactory", e);
+ LOG.debug("Can't create SAAJ MessageFactory", e);
}
}
diff --git
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/AbstractSAMLCallbackHandler.java
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/AbstractSAMLCallbackHandler.java
index 3bdd0bc2a..97ed3935f 100644
---
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/AbstractSAMLCallbackHandler.java
+++
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/AbstractSAMLCallbackHandler.java
@@ -20,6 +20,7 @@
package org.apache.wss4j.dom.common;
import org.apache.wss4j.dom.WSConstants;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
import org.apache.wss4j.common.crypto.Crypto;
import org.apache.wss4j.common.saml.SAMLCallback;
import org.apache.wss4j.common.saml.bean.ActionBean;
@@ -235,8 +236,7 @@ public abstract class AbstractSAMLCallbackHandler
implements CallbackHandler {
} else if (statement == Statement.ATTR) {
// Build a new Document
DocumentBuilderFactory docBuilderFactory =
- DocumentBuilderFactory.newInstance();
- docBuilderFactory.setNamespaceAware(true);
+ SecureDocumentBuilderFactory.newNSInstance();
DocumentBuilder docBuilder =
docBuilderFactory.newDocumentBuilder();
Document doc = docBuilder.newDocument();
diff --git
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/SAMLElementCallbackHandler.java
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/SAMLElementCallbackHandler.java
index 3ff1e92a2..0d13fa7de 100644
---
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/SAMLElementCallbackHandler.java
+++
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/SAMLElementCallbackHandler.java
@@ -26,6 +26,7 @@ import
javax.security.auth.callback.UnsupportedCallbackException;
import javax.xml.parsers.DocumentBuilderFactory;
import org.apache.wss4j.common.saml.SamlAssertionWrapper;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
import org.apache.wss4j.common.saml.SAMLCallback;
import org.apache.wss4j.common.saml.SAMLUtil;
import org.apache.wss4j.common.saml.builder.SAML1Constants;
@@ -75,7 +76,7 @@ public class SAMLElementCallbackHandler extends
AbstractSAMLCallbackHandler {
SamlAssertionWrapper samlAssertionWrapper = new
SamlAssertionWrapper(samlCallback);
- DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+ DocumentBuilderFactory factory =
SecureDocumentBuilderFactory.newInstance();
return
samlAssertionWrapper.toDOM(factory.newDocumentBuilder().newDocument());
}
diff --git
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java
index f95a29509..bff157992 100644
---
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java
+++
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java
@@ -24,6 +24,7 @@ import org.apache.wss4j.dom.WSConstants;
import org.apache.wss4j.dom.common.KeystoreCallbackHandler;
import org.apache.wss4j.dom.engine.WSSecurityEngine;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
import org.apache.wss4j.common.crypto.Crypto;
import org.apache.wss4j.common.crypto.CryptoFactory;
import org.apache.wss4j.common.ext.WSSecurityException;
@@ -120,8 +121,7 @@ public class CryptoProviderTest {
outputString.replace("1.2.840.113549.1.9.1=#16125765726e6572406578616d706c652e636f6d",
"[email protected]");
- DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
- dbf.setNamespaceAware(true);
+ DocumentBuilderFactory dbf =
SecureDocumentBuilderFactory.newNSInstance();
InputStream is = new ByteArrayInputStream(outputString.getBytes());
Document parsedDoc = dbf.newDocumentBuilder().parse(is);
verify(parsedDoc);
@@ -148,8 +148,7 @@ public class CryptoProviderTest {
outputString.replace("1.2.840.113549.1.9.1=#16125765726e6572406578616d706c652e636f6d",
"[email protected]");
- DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
- dbf.setNamespaceAware(true);
+ DocumentBuilderFactory dbf =
SecureDocumentBuilderFactory.newNSInstance();
InputStream is = new ByteArrayInputStream(outputString.getBytes());
Document parsedDoc = dbf.newDocumentBuilder().parse(is);
verify(parsedDoc);
diff --git
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/handler/CustomTokenTest.java
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/handler/CustomTokenTest.java
index 03495186e..05f0bbce6 100644
---
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/handler/CustomTokenTest.java
+++
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/handler/CustomTokenTest.java
@@ -28,6 +28,7 @@ import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.UnsupportedCallbackException;
import javax.xml.parsers.DocumentBuilderFactory;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
import org.apache.wss4j.common.ext.WSPasswordCallback;
import org.apache.wss4j.common.util.SOAPUtil;
import org.apache.wss4j.common.util.XMLUtils;
@@ -58,8 +59,7 @@ public class CustomTokenTest {
@Test
public void testCustomTokenTimestamp() throws Exception {
// Create a Timestamp manually
- DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
- dbf.setNamespaceAware(true);
+ DocumentBuilderFactory dbf =
SecureDocumentBuilderFactory.newNSInstance();
Document timestampDoc = dbf.newDocumentBuilder().newDocument();
WSSecTimestamp timestamp = new WSSecTimestamp(timestampDoc);
diff --git
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePrefixListTest.java
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePrefixListTest.java
index 63521643e..911bc4a67 100644
---
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePrefixListTest.java
+++
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePrefixListTest.java
@@ -32,6 +32,7 @@ import javax.xml.crypto.dsig.spec.ExcC14NParameterSpec;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
import org.apache.wss4j.common.crypto.Crypto;
import org.apache.wss4j.common.crypto.CryptoFactory;
import org.apache.wss4j.common.crypto.CryptoType;
@@ -72,8 +73,7 @@ public class SignaturePrefixListTest {
Document doc = null;
try (InputStream inputStream =
Loader.getResource("org/apache/wss4j/dom/message/SignaturePrefixListMessage.xml").openStream())
{
- DocumentBuilderFactory factory =
DocumentBuilderFactory.newInstance();
- factory.setNamespaceAware(true);
+ DocumentBuilderFactory factory =
SecureDocumentBuilderFactory.newNSInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
doc = builder.parse(inputStream);
}
diff --git
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignatureTest.java
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignatureTest.java
index 06bb4e9f9..128f13db5 100644
---
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignatureTest.java
+++
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignatureTest.java
@@ -35,6 +35,7 @@ import javax.xml.crypto.dsig.keyinfo.X509Data;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
import org.apache.wss4j.common.WSEncryptionPart;
import org.apache.wss4j.common.bsp.BSPRule;
import org.apache.wss4j.common.crypto.Crypto;
@@ -1032,8 +1033,7 @@ public class SignatureTest {
// Create the KeyInfo
DocumentBuilderFactory docBuilderFactory =
- DocumentBuilderFactory.newInstance();
- docBuilderFactory.setNamespaceAware(true);
+ SecureDocumentBuilderFactory.newNSInstance();
DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder();
Document keyInfoDoc = docBuilder.newDocument();
diff --git
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/DerivedKeyTokenTest.java
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/DerivedKeyTokenTest.java
index 723997990..5d8fa3ec1 100644
---
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/DerivedKeyTokenTest.java
+++
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/DerivedKeyTokenTest.java
@@ -19,6 +19,7 @@
package org.apache.wss4j.dom.message.token;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
import org.apache.wss4j.common.bsp.BSPEnforcer;
@@ -93,9 +94,8 @@ public class DerivedKeyTokenTest {
final java.io.InputStream in = new java.io.ByteArrayInputStream(
template.replaceFirst("PLACEHOLDER1", placeholder1)
.replaceFirst("PLACEHOLDER2",
placeholder2).getBytes());
- final javax.xml.parsers.DocumentBuilderFactory factory =
javax.xml.parsers.DocumentBuilderFactory
- .newInstance();
- factory.setNamespaceAware(true);
+ final javax.xml.parsers.DocumentBuilderFactory factory =
SecureDocumentBuilderFactory
+ .newNSInstance();
final javax.xml.parsers.DocumentBuilder builder = factory
.newDocumentBuilder();
return builder.parse(in);
diff --git
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/ReferenceTest.java
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/ReferenceTest.java
index 508aa05c7..406eb6500 100644
---
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/ReferenceTest.java
+++
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/ReferenceTest.java
@@ -19,6 +19,7 @@
package org.apache.wss4j.dom.message.token;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
import org.apache.wss4j.common.ext.WSSecurityException;
import org.apache.wss4j.common.token.Reference;
@@ -155,8 +156,7 @@ public class ReferenceTest {
).getBytes()
);
final javax.xml.parsers.DocumentBuilderFactory factory =
- javax.xml.parsers.DocumentBuilderFactory.newInstance();
- factory.setNamespaceAware(true);
+ SecureDocumentBuilderFactory.newNSInstance();
final javax.xml.parsers.DocumentBuilder builder =
factory.newDocumentBuilder();
return builder.parse(in);
}
diff --git
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenTest.java
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenTest.java
index 148e9dd47..164584d01 100644
--- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenTest.java
+++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenTest.java
@@ -35,6 +35,7 @@ import javax.crypto.SecretKey;
import javax.security.auth.callback.CallbackHandler;
import javax.xml.parsers.DocumentBuilderFactory;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
import org.apache.wss4j.common.bsp.BSPRule;
import org.apache.wss4j.common.crypto.Crypto;
import org.apache.wss4j.common.crypto.CryptoFactory;
@@ -1028,8 +1029,7 @@ public class SamlTokenTest {
SAMLUtil.doSAMLCallback(callbackHandler, samlCallback);
SamlAssertionWrapper samlAssertion = new
SamlAssertionWrapper(samlCallback);
- DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
- dbf.setNamespaceAware(true);
+ DocumentBuilderFactory dbf =
SecureDocumentBuilderFactory.newNSInstance();
Document doc = dbf.newDocumentBuilder().newDocument();
String assertionString =
DOM2Writer.nodeToString(samlAssertion.toDOM(doc));
@@ -1058,8 +1058,7 @@ public class SamlTokenTest {
// Convert String to DOM + into an assertionWrapper
InputStream in = new ByteArrayInputStream(assertionString.getBytes());
- DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
- dbf.setNamespaceAware(true);
+ DocumentBuilderFactory dbf =
SecureDocumentBuilderFactory.newNSInstance();
Document newDoc = dbf.newDocumentBuilder().parse(in);
SamlAssertionWrapper newAssertion =
diff --git
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SignedSamlTokenHOKTest.java
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SignedSamlTokenHOKTest.java
index f556528d1..c4a55243c 100644
---
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SignedSamlTokenHOKTest.java
+++
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SignedSamlTokenHOKTest.java
@@ -32,6 +32,7 @@ import org.apache.wss4j.dom.engine.WSSecurityEngine;
import org.apache.wss4j.dom.engine.WSSecurityEngineResult;
import org.apache.wss4j.dom.handler.RequestData;
import org.apache.wss4j.dom.handler.WSHandlerResult;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
import org.apache.wss4j.common.bsp.BSPRule;
import org.apache.wss4j.common.crypto.Crypto;
import org.apache.wss4j.common.crypto.CryptoFactory;
@@ -710,8 +711,7 @@ public class SignedSamlTokenHOKTest {
// Create the KeyInfo
DocumentBuilderFactory docBuilderFactory =
- DocumentBuilderFactory.newInstance();
- docBuilderFactory.setNamespaceAware(true);
+ SecureDocumentBuilderFactory.newNSInstance();
DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder();
Document keyInfoDoc = docBuilder.newDocument();
diff --git
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/ext/AssertionSigningTest.java
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/ext/AssertionSigningTest.java
index 15d4d7e63..c6b7406aa 100644
---
a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/ext/AssertionSigningTest.java
+++
b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/ext/AssertionSigningTest.java
@@ -24,6 +24,7 @@ import java.security.KeyStore;
import javax.xml.parsers.DocumentBuilderFactory;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
import org.apache.wss4j.common.crypto.Crypto;
import org.apache.wss4j.common.crypto.CryptoType;
import org.apache.wss4j.common.crypto.Merlin;
@@ -81,8 +82,7 @@ public class AssertionSigningTest {
input.close();
((Merlin) issuerCrypto).setKeyStore(keyStore);
- dbf = DocumentBuilderFactory.newInstance();
- dbf.setNamespaceAware(true);
+ dbf = SecureDocumentBuilderFactory.newNSInstance();
}
/**
diff --git
a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java
b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java
index b9feb4dfe..5a1a14a8c 100644
---
a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java
+++
b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java
@@ -18,6 +18,7 @@
*/
package org.apache.wss4j.policy.stax.test;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
import org.apache.neethi.builders.AssertionBuilder;
import org.apache.wss4j.common.crypto.WSProviderConfig;
import org.apache.wss4j.common.ext.WSSecurityException;
@@ -85,8 +86,7 @@ public class AbstractPolicyTestBase extends AbstractTestBase {
protected PolicyEnforcer buildAndStartPolicyEngine(
String policyString, boolean replacePolicyElement,
List<AssertionBuilder<Element>> customAssertionBuilders)
throws ParserConfigurationException, SAXException, IOException,
WSSPolicyException {
- DocumentBuilderFactory documentBuilderFactory =
DocumentBuilderFactory.newInstance();
- documentBuilderFactory.setNamespaceAware(true);
+ DocumentBuilderFactory documentBuilderFactory =
SecureDocumentBuilderFactory.newNSInstance();
documentBuilderFactory.setValidating(false);
DocumentBuilder documentBuilder =
documentBuilderFactory.newDocumentBuilder();
Document document = documentBuilder.parse(
diff --git
a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AsymmetricBindingIntegrationTest.java
b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AsymmetricBindingIntegrationTest.java
index 55f751b42..6a53b7e20 100644
---
a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AsymmetricBindingIntegrationTest.java
+++
b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AsymmetricBindingIntegrationTest.java
@@ -30,10 +30,10 @@ import java.util.List;
import javax.xml.namespace.QName;
import javax.xml.stream.XMLStreamException;
import javax.xml.transform.Transformer;
-import javax.xml.transform.TransformerFactory;
import javax.xml.transform.dom.DOMSource;
import javax.xml.transform.stream.StreamResult;
+import org.apache.commons.xml.secure.SecureTransformerFactory;
import org.apache.wss4j.common.bsp.BSPRule;
import org.apache.wss4j.common.crypto.CryptoType;
import org.apache.wss4j.common.crypto.Merlin;
@@ -154,7 +154,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -297,7 +297,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -404,7 +404,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -532,7 +532,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -654,7 +654,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -783,7 +783,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -904,7 +904,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -1016,7 +1016,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -1136,7 +1136,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -1253,7 +1253,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -1369,7 +1369,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -1478,7 +1478,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -1587,7 +1587,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -1701,7 +1701,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -1829,7 +1829,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -1930,7 +1930,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -2039,7 +2039,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -2301,7 +2301,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -2429,7 +2429,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -2537,7 +2537,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -2651,7 +2651,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -2755,7 +2755,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -2860,7 +2860,7 @@ public class AsymmetricBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
diff --git
a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/TransportBindingIntegrationTest.java
b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/TransportBindingIntegrationTest.java
index 2d83be4ad..e8d629b40 100644
---
a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/TransportBindingIntegrationTest.java
+++
b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/TransportBindingIntegrationTest.java
@@ -29,10 +29,10 @@ import java.util.List;
import javax.xml.namespace.QName;
import javax.xml.stream.XMLStreamException;
import javax.xml.transform.Transformer;
-import javax.xml.transform.TransformerFactory;
import javax.xml.transform.dom.DOMSource;
import javax.xml.transform.stream.StreamResult;
+import org.apache.commons.xml.secure.SecureTransformerFactory;
import org.apache.wss4j.common.bsp.BSPRule;
import org.apache.wss4j.common.ext.WSSecurityException;
import org.apache.wss4j.policy.stax.enforcer.PolicyEnforcer;
@@ -145,7 +145,7 @@ public class TransportBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -248,7 +248,7 @@ public class TransportBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -370,7 +370,7 @@ public class TransportBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -485,7 +485,7 @@ public class TransportBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -586,7 +586,7 @@ public class TransportBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -708,7 +708,7 @@ public class TransportBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -816,7 +816,7 @@ public class TransportBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -948,7 +948,7 @@ public class TransportBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -1069,7 +1069,7 @@ public class TransportBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -1187,7 +1187,7 @@ public class TransportBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -1307,7 +1307,7 @@ public class TransportBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
@@ -1424,7 +1424,7 @@ public class TransportBindingIntegrationTest extends
AbstractPolicyTestBase {
Document document = doInboundSecurity(inSecurityProperties, new
ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer);
//read the whole stream:
- Transformer transformer =
TransformerFactory.newInstance().newTransformer();
+ Transformer transformer =
SecureTransformerFactory.newInstance().newTransformer();
transformer.transform(new DOMSource(document), new StreamResult(
new OutputStream() {
@Override
diff --git
a/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/DocumentCreatorImpl.java
b/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/DocumentCreatorImpl.java
index bc7ec5890..19e62f072 100644
---
a/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/DocumentCreatorImpl.java
+++
b/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/DocumentCreatorImpl.java
@@ -18,12 +18,13 @@
*/
package org.apache.wss4j.stax.ext;
-import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
import org.w3c.dom.Document;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
+
/**
* A default (inefficient) implementation of DocumentCreator which creates a
new DocumentBuilderFactory
* implementation per-instance of this class. CXF instead uses a lambda to
call the CXF DomUtils class
@@ -34,10 +35,7 @@ public class DocumentCreatorImpl implements DocumentCreator {
private final DocumentBuilderFactory documentBuilderFactory;
public DocumentCreatorImpl() throws ParserConfigurationException {
- documentBuilderFactory = DocumentBuilderFactory.newInstance();
- documentBuilderFactory.setNamespaceAware(true);
-
documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
-
documentBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl";,
true);
+ documentBuilderFactory = SecureDocumentBuilderFactory.newNSInstance();
}
public Document newDocument() throws ParserConfigurationException {
diff --git
a/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/InboundWSSec.java
b/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/InboundWSSec.java
index 5adbbbcf3..3f11162aa 100644
---
a/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/InboundWSSec.java
+++
b/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/InboundWSSec.java
@@ -28,6 +28,7 @@ import javax.xml.stream.XMLInputFactory;
import javax.xml.stream.XMLStreamException;
import javax.xml.stream.XMLStreamReader;
+import org.apache.commons.xml.secure.SecureXMLInputFactory;
import org.apache.wss4j.common.ext.WSSecurityException;
import org.apache.wss4j.stax.ext.DocumentCreatorImpl;
import org.apache.wss4j.stax.ext.WSSConstants;
@@ -72,7 +73,7 @@ public class InboundWSSec {
protected static final transient org.slf4j.Logger LOG =
org.slf4j.LoggerFactory.getLogger(InboundWSSec.class);
- private static final XMLInputFactory XML_INPUT_FACTORY =
XMLInputFactory.newInstance();
+ private static final XMLInputFactory XML_INPUT_FACTORY =
SecureXMLInputFactory.newInstance();
static {
XML_INPUT_FACTORY.setProperty(XMLInputFactory.SUPPORT_DTD, false);
diff --git
a/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/WSSec.java
b/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/WSSec.java
index 29b98fb4b..15d6ce6b6 100644
--- a/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/WSSec.java
+++ b/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/WSSec.java
@@ -31,6 +31,7 @@ import javax.xml.transform.stream.StreamSource;
import javax.xml.validation.Schema;
import javax.xml.validation.SchemaFactory;
+import org.apache.commons.xml.secure.SecureSchemaFactory;
import org.apache.wss4j.common.crypto.WSProviderConfig;
import org.apache.wss4j.common.ext.WSSecurityException;
import org.apache.wss4j.stax.ext.WSSConfigurationException;
@@ -458,8 +459,7 @@ public class WSSec {
}
public static Schema loadWSSecuritySchemas() throws SAXException {
- SchemaFactory schemaFactory =
SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
- schemaFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING,
Boolean.TRUE);
+ SchemaFactory schemaFactory =
SecureSchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
schemaFactory.setResourceResolver(new LSResourceResolver() {
@Override
public LSInput resolveResource(String type, String namespaceURI,
String publicId, String systemId, String baseURI) {
diff --git
a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AbstractTestBase.java
b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AbstractTestBase.java
index 48f5b875d..955f1df8f 100644
---
a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AbstractTestBase.java
+++
b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AbstractTestBase.java
@@ -48,6 +48,10 @@ import javax.xml.xpath.XPathExpression;
import javax.xml.xpath.XPathExpressionException;
import javax.xml.xpath.XPathFactory;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
+import org.apache.commons.xml.secure.SecureTransformerFactory;
+import org.apache.commons.xml.secure.SecureXMLInputFactory;
+import org.apache.commons.xml.secure.SecureXPathFactory;
import org.apache.wss4j.common.bsp.BSPRule;
import org.apache.wss4j.common.crypto.Crypto;
import org.apache.wss4j.common.crypto.CryptoFactory;
@@ -90,8 +94,8 @@ public abstract class AbstractTestBase {
//javax.xml.transform.Transformer transformer =
TransformerFactory.newInstance().newTransformer();
//transformer.transform(new StreamSource(new
ByteArrayInputStream(baos.toByteArray())), new StreamResult(System.out));
- protected static final XMLInputFactory xmlInputFactory =
XMLInputFactory.newInstance();
- protected static final TransformerFactory TRANSFORMER_FACTORY =
TransformerFactory.newInstance();
+ protected static final XMLInputFactory xmlInputFactory =
SecureXMLInputFactory.newInstance();
+ protected static final TransformerFactory TRANSFORMER_FACTORY =
SecureTransformerFactory.newInstance();
protected DocumentBuilderFactory documentBuilderFactory;
protected static final String SECURED_DOCUMENT = "securedDocument";
@@ -103,13 +107,11 @@ public abstract class AbstractTestBase {
}
public AbstractTestBase() {
- documentBuilderFactory = DocumentBuilderFactory.newInstance();
- documentBuilderFactory.setNamespaceAware(true);
+ documentBuilderFactory = SecureDocumentBuilderFactory.newNSInstance();
documentBuilderFactory.setIgnoringComments(false);
documentBuilderFactory.setCoalescing(false);
documentBuilderFactory.setIgnoringElementContentWhitespace(false);
xmlInputFactory.setProperty(XMLInputFactory.IS_COALESCING, false);
- xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
//xmlInputFactory.setProperty(WstxInputProperties.P_MIN_TEXT_SEGMENT,
new Integer(5 * 8192));
}
@@ -311,7 +313,7 @@ public abstract class AbstractTestBase {
}
protected XPathExpression getXPath(String expression) throws
XPathExpressionException {
- XPathFactory xPathFactory = XPathFactory.newInstance();
+ XPathFactory xPathFactory = SecureXPathFactory.newInstance();
XPath xPath = xPathFactory.newXPath();
xPath.setNamespaceContext(
new NamespaceContext() {
diff --git
a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/EncDecryptionTest.java
b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/EncDecryptionTest.java
index 94148b59c..abbc8a021 100644
---
a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/EncDecryptionTest.java
+++
b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/EncDecryptionTest.java
@@ -48,6 +48,7 @@ import javax.xml.xpath.XPathExpression;
import org.apache.commons.compress.compressors.gzip.GzipCompressorInputStream;
import org.apache.commons.compress.compressors.gzip.GzipCompressorOutputStream;
+import org.apache.commons.xml.secure.SecureTransformerFactory;
import org.apache.wss4j.common.ConfigurationConstants;
import org.apache.wss4j.common.WSEncryptionPart;
import org.apache.wss4j.common.bsp.BSPRule;
@@ -1634,7 +1635,7 @@ public class EncDecryptionTest extends AbstractTestBase {
assertEquals(nodeList.getLength(), 1);
//move ReferenceList...
- TransformerFactory transFact = TransformerFactory.newInstance();
+ TransformerFactory transFact =
SecureTransformerFactory.newInstance();
Transformer trans = transFact.newTransformer(new
StreamSource(this.getClass().getClassLoader().getResourceAsStream("xsl/testDecryptionReferenceListOutsideEncryptedKey.xsl")));
baos.reset();
trans.transform(new DOMSource(document), new StreamResult(baos));
diff --git
a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/FaultTest.java
b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/FaultTest.java
index 56a90b043..a5d444fd8 100644
--- a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/FaultTest.java
+++ b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/FaultTest.java
@@ -29,6 +29,7 @@ import javax.xml.stream.XMLStreamReader;
import javax.xml.transform.dom.DOMSource;
import javax.xml.transform.stream.StreamResult;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
import org.apache.wss4j.dom.handler.WSHandlerConstants;
import org.apache.wss4j.stax.ext.WSSConstants;
import org.apache.wss4j.stax.ext.WSSSecurityProperties;
@@ -102,8 +103,7 @@ public class FaultTest extends AbstractTestBase {
ByteArrayOutputStream baos = new ByteArrayOutputStream();
{
InputStream sourceDocument =
this.getClass().getClassLoader().getResourceAsStream("testdata/soap-fault.xml");
- DocumentBuilderFactory factory =
DocumentBuilderFactory.newInstance();
- factory.setNamespaceAware(true);
+ DocumentBuilderFactory factory =
SecureDocumentBuilderFactory.newNSInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document securedDocument = builder.parse(sourceDocument);
diff --git
a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLCallbackHandlerImpl.java
b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLCallbackHandlerImpl.java
index 8084c0115..d00b41e2b 100644
---
a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLCallbackHandlerImpl.java
+++
b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLCallbackHandlerImpl.java
@@ -34,6 +34,7 @@ import
javax.security.auth.callback.UnsupportedCallbackException;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
import org.apache.wss4j.common.crypto.Merlin;
import org.apache.wss4j.common.saml.SAMLCallback;
import org.apache.wss4j.common.saml.bean.ActionBean;
@@ -202,8 +203,7 @@ public class SAMLCallbackHandlerImpl implements
CallbackHandler {
} else if (statement == Statement.ATTR) {
// Build a new Document
DocumentBuilderFactory docBuilderFactory =
- DocumentBuilderFactory.newInstance();
- docBuilderFactory.setNamespaceAware(true);
+ SecureDocumentBuilderFactory.newNSInstance();
DocumentBuilder docBuilder =
docBuilderFactory.newDocumentBuilder();
Document doc = docBuilder.newDocument();
