vbhanuchander-lang opened a new pull request, #8026:
URL: https://github.com/apache/hop/pull/8026
Addresses #3270.
The XSD validator transform and the XSD validator action both harden the
`Validator` they create
against XXE, but neither configures the `SchemaFactory` that produces it.
The factory is what
resolves the schema document itself, so before validation even begins a
schema was free to pull in
an external DTD or another schema over the network — and in the "no need to
specify XSD" mode the
XML document chooses that location itself through `xsi:schemaLocation`.
This adds `XmlParserFactoryProducer.createSecureSchemaFactory(String)` next
to the existing
`createSecureDocBuilderFactory` and `createSecureSAXParserFactory` helpers,
and uses it from both
call sites.
### Why external schema access is restricted rather than denied
The obvious fix — enable `FEATURE_SECURE_PROCESSING` and set both access
properties to `""` — is a
regression. With secure processing on, Xerces refuses *every* external
schema reference, including
`xs:include` and `xs:import` of a schema document sitting next to the first
one on local disk. Any
multi-file XSD stops compiling.
So `accessExternalSchema` is set to `file` instead of `""`: local schema
composition keeps working
while a fetch over http, https or ftp is refused. `accessExternalDTD` is
denied outright, since a
DTD reference from inside an XSD has no legitimate use here.
Both call sites keep honouring their existing `allowExternalEntities`
option, so a pipeline or
workflow that deliberately relies on remote schemas is unaffected — it opts
out exactly as it
already does for the validator.
### Tests
Three tests in `XmlUtilsTest`, which is the existing unit test for
`XmlParserFactoryProducer`:
- the factory reports `FEATURE_SECURE_PROCESSING` enabled
- a schema whose `xs:include` points at an http URL is refused, with the
access-restriction message,
without contacting the host
- a schema whose `xs:include` points at a sibling file on disk still compiles
Both behavioural tests fail if the change is reverted, in opposite
directions: without the
restrictions the remote reference is fetched instead of refused, and with
`accessExternalSchema` set
to `""` rather than `file` the local include stops resolving.
One note for reviewers: Xerces' `XMLSchemaFactory` accepts `setProperty` for
`accessExternalDTD` but
rejects `getProperty` for the same name as unrecognized, so the two property
values are asserted
through their effect rather than read back.
### Verification
- `mvn -pl core -Dtest=XmlUtilsTest test` — 5/5 pass
- `mvn -pl plugins/transforms/xml,plugins/actions/xml -Pskip-uitest test` —
153 pass, 0 failures,
including the existing `XsdValidatorIntTest`
- `mvn spotless:check` and `mvn apache-rat:check` pass on the three touched
modules
------------------------
- [x] I hereby declare this contribution to be licensed under the [Apache
License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
