coheigea commented on code in PR #407:
URL: https://github.com/apache/cxf-xjc-utils/pull/407#discussion_r4344652662
##########
cxf-xjc-plugin/src/main/java/org/apache/cxf/maven_plugin/XSDToJavaRunner.java:
##########
@@ -94,6 +94,36 @@ private static File getFile(String s, XJCErrorListener l)
throws Exception {
}
}
+ /**
+ * Parses an XML catalog with external DTD and schema access disabled, so
that a catalog
+ * cannot be used as an XXE vector (reading local files or making network
requests while it
+ * is parsed). A legitimate OASIS XML catalog needs neither, so this does
not restrict normal
+ * use. The restriction is applied only around the catalog parse and then
restored, so it does
+ * not affect how the schemas themselves are parsed.
+ */
+ static void parseCatalog(CatalogResolver catalogResolver, String
catalogPath) throws IOException {
+ String dtdKey = "javax.xml.accessExternalDTD";
+ String schemaKey = "javax.xml.accessExternalSchema";
+ String dtd = System.getProperty(dtdKey);
Review Comment:
Good point, thanks — switched away from the system property. I did test the
property approach and it happened to work (xml-resolver builds a fresh
SAXParser per parseCatalog, so the JDK reads accessExternalDTD each time), but
relying on that is fragile as you say. The reader now uses a SAXParserFactory
with secure processing and external entity/DTD resolution disabled, registered
the same way Catalog.setupReaders does. DOCTYPE is still allowed so OASIS
catalogs that declare the catalog DTD keep working; only external fetches are
blocked. No system properties touched.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
