Skip to content

Commit 7d19340

Browse files
committed
XML External Entity (XXE) injection in XmlConverter. Thanks to Stephan Siano for the patch.
1 parent 1df5596 commit 7d19340

File tree

2 files changed

+17
-5
lines changed

2 files changed

+17
-5
lines changed

Diff for: camel-core/src/main/java/org/apache/camel/converter/jaxp/XmlConverter.java

+6
Original file line numberDiff line numberDiff line change
@@ -596,6 +596,12 @@ public SAXSource toSAXSourceFromStream(StreamSource source, Exchange exchange) t
596596
} catch (Exception e) {
597597
LOG.warn("SAXParser doesn't support the feature {} with value {}, due to {}.", new Object[]{javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, "true", e});
598598
}
599+
try {
600+
sfactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
601+
} catch (SAXException e) {
602+
LOG.warn("SAXParser doesn't support the feature {} with value {}, due to {}."
603+
, new Object[]{"http://xml.org/sax/features/external-general-entities", false, e});
604+
}
599605
}
600606
sfactory.setNamespaceAware(true);
601607
SAXParser parser = sfactory.newSAXParser();

Diff for: camel-core/src/test/java/org/apache/camel/component/xslt/XsltDTDTest.java

+11-5
Original file line numberDiff line numberDiff line change
@@ -57,19 +57,25 @@ private void sendEntityMessage(Object message) throws Exception {
5757
Exchange exchange = list.get(0);
5858
String xml = exchange.getIn().getBody(String.class);
5959
assertTrue("Get a wrong transformed message", xml.indexOf("<transformed subject=\"\">") > 0);
60-
61-
62-
60+
6361
try {
62+
endpoint.reset();
63+
endpoint.expectedMessageCount(1);
64+
6465
template.sendBody("direct:start2", message);
65-
fail("Expect an exception here");
66+
67+
assertMockEndpointsSatisfied();
68+
69+
list = endpoint.getReceivedExchanges();
70+
exchange = list.get(0);
71+
xml = exchange.getIn().getBody(String.class);
72+
assertTrue("Get a wrong transformed message", xml.indexOf("<transformed subject=\"\">") > 0);
6673
} catch (Exception ex) {
6774
// expect an exception here
6875
assertTrue("Get a wrong exception", ex instanceof CamelExecutionException);
6976
// the file could not be found
7077
assertTrue("Get a wrong exception cause", ex.getCause() instanceof TransformerException);
7178
}
72-
7379
}
7480

7581

0 commit comments

Comments
 (0)