This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch 4.1.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/4.1.x-fixes by this push:
new acbe28dae0 Harden SchemaFactory and TransformerFactory with
XMLConstants.FEATURE_SECURE_PROCESSING (#3006)
acbe28dae0 is described below
commit acbe28dae0aecd437e14a6d1f846f7cd48e576fe
Author: Andriy Redko <[email protected]>
AuthorDate: Fri Apr 10 14:01:02 2026 -0400
Harden SchemaFactory and TransformerFactory with
XMLConstants.FEATURE_SECURE_PROCESSING (#3006)
(cherry picked from commit 43c773363099884f8544a97e9b4d6431ae8d66bf)
---
.../validationtransformation/XSDResourceTypeIdentifier.java | 11 +++++++++++
.../validationtransformation/XSDResourceValidator.java | 11 +++++++++++
.../validationtransformation/XSLTResourceTransformer.java | 11 ++++++++++-
systests/ws-transfer/pom.xml | 4 ++--
4 files changed, 34 insertions(+), 3 deletions(-)
diff --git
a/rt/ws/transfer/src/main/java/org/apache/cxf/ws/transfer/validationtransformation/XSDResourceTypeIdentifier.java
b/rt/ws/transfer/src/main/java/org/apache/cxf/ws/transfer/validationtransformation/XSDResourceTypeIdentifier.java
index e8f4b820ac..d34aad87b7 100644
---
a/rt/ws/transfer/src/main/java/org/apache/cxf/ws/transfer/validationtransformation/XSDResourceTypeIdentifier.java
+++
b/rt/ws/transfer/src/main/java/org/apache/cxf/ws/transfer/validationtransformation/XSDResourceTypeIdentifier.java
@@ -20,6 +20,7 @@
package org.apache.cxf.ws.transfer.validationtransformation;
import java.io.IOException;
+import java.util.logging.Level;
import java.util.logging.Logger;
import javax.xml.XMLConstants;
@@ -32,6 +33,8 @@ import javax.xml.validation.Validator;
import org.w3c.dom.Node;
import org.xml.sax.SAXException;
+import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
import jakarta.annotation.Resource;
import jakarta.xml.ws.WebServiceContext;
@@ -60,6 +63,14 @@ public class XSDResourceTypeIdentifier implements
ResourceTypeIdentifier {
try {
this.resourceTransformer = resourceTransformer;
SchemaFactory schemaFactory =
SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
+ schemaFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING,
Boolean.TRUE);
+ try {
+ schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,
"");
+ schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA,
"");
+ } catch (SAXNotRecognizedException | SAXNotSupportedException e) {
+ LOG.log(Level.WARNING, "The properties '" +
XMLConstants.ACCESS_EXTERNAL_DTD
+ + "', '" + XMLConstants.ACCESS_EXTERNAL_SCHEMA + "' are
not supported.");
+ }
Schema schema = schemaFactory.newSchema(xsd);
this.validator = schema.newValidator();
} catch (SAXException ex) {
diff --git
a/rt/ws/transfer/src/main/java/org/apache/cxf/ws/transfer/validationtransformation/XSDResourceValidator.java
b/rt/ws/transfer/src/main/java/org/apache/cxf/ws/transfer/validationtransformation/XSDResourceValidator.java
index 70ba865673..7d9b544b3a 100644
---
a/rt/ws/transfer/src/main/java/org/apache/cxf/ws/transfer/validationtransformation/XSDResourceValidator.java
+++
b/rt/ws/transfer/src/main/java/org/apache/cxf/ws/transfer/validationtransformation/XSDResourceValidator.java
@@ -20,6 +20,7 @@
package org.apache.cxf.ws.transfer.validationtransformation;
import java.io.IOException;
+import java.util.logging.Level;
import java.util.logging.Logger;
import javax.xml.XMLConstants;
@@ -32,6 +33,8 @@ import javax.xml.validation.Validator;
import org.w3c.dom.Node;
import org.xml.sax.SAXException;
+import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
import jakarta.annotation.Resource;
import jakarta.xml.ws.WebServiceContext;
@@ -57,6 +60,14 @@ public class XSDResourceValidator implements
ResourceValidator {
public XSDResourceValidator(Source xsd, ResourceTransformer
resourceTransformer) {
try {
SchemaFactory schemaFactory =
SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
+ schemaFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING,
Boolean.TRUE);
+ try {
+ schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,
"");
+ schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA,
"");
+ } catch (SAXNotRecognizedException | SAXNotSupportedException e) {
+ LOG.log(Level.WARNING, "The properties '" +
XMLConstants.ACCESS_EXTERNAL_DTD
+ + "', '" + XMLConstants.ACCESS_EXTERNAL_SCHEMA + "' are
not supported.");
+ }
Schema schema = schemaFactory.newSchema(xsd);
this.validator = schema.newValidator();
} catch (SAXException ex) {
diff --git
a/rt/ws/transfer/src/main/java/org/apache/cxf/ws/transfer/validationtransformation/XSLTResourceTransformer.java
b/rt/ws/transfer/src/main/java/org/apache/cxf/ws/transfer/validationtransformation/XSLTResourceTransformer.java
index caeb339a1b..44a511ba4b 100644
---
a/rt/ws/transfer/src/main/java/org/apache/cxf/ws/transfer/validationtransformation/XSLTResourceTransformer.java
+++
b/rt/ws/transfer/src/main/java/org/apache/cxf/ws/transfer/validationtransformation/XSLTResourceTransformer.java
@@ -21,6 +21,7 @@ package org.apache.cxf.ws.transfer.validationtransformation;
import java.util.logging.Logger;
+import javax.xml.XMLConstants;
import javax.xml.transform.Source;
import javax.xml.transform.Templates;
import javax.xml.transform.TransformerConfigurationException;
@@ -61,7 +62,15 @@ public class XSLTResourceTransformer implements
ResourceTransformer {
public XSLTResourceTransformer(Source xsl, ResourceValidator validator) {
this.validator = validator;
try {
- templates = TransformerFactory.newInstance().newTemplates(xsl);
+ final TransformerFactory transformerFactory =
TransformerFactory.newInstance();
+ try {
+
transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+
transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+ } catch (IllegalArgumentException ex) {
+ // ignore
+ }
+
transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING,
Boolean.TRUE);
+ templates = transformerFactory.newTemplates(xsl);
} catch (TransformerConfigurationException e) {
LOG.severe(e.getLocalizedMessage());
throw new SoapFault("Internal error",
getSoapVersion().getReceiver());
diff --git a/systests/ws-transfer/pom.xml b/systests/ws-transfer/pom.xml
index d1ded04d1d..3d00b6bd90 100644
--- a/systests/ws-transfer/pom.xml
+++ b/systests/ws-transfer/pom.xml
@@ -69,9 +69,9 @@
</dependencies>
<profiles>
<profile>
- <id>jdk24</id>
+ <id>jdk17</id>
<activation>
- <jdk>[24,)</jdk>
+ <jdk>[17,)</jdk>
</activation>
<build>
<plugins>
