ISPN-9679 Move property replacement to the XMLStreamReader

core/src/main/java/org/infinispan/configuration/parsing/ParserRegistry.java

@@ -17,6 +17,7 @@
 import java.util.Collection;
 import java.util.Collections;
 import java.util.Map;
+import java.util.Properties;
 import java.util.ServiceLoader;
 import java.util.concurrent.ConcurrentMap;
 
@@ -58,18 +59,20 @@ public class ParserRegistry implements NamespaceMappingParser {
    private static final Log log = LogFactory.getLog(ParserRegistry.class);
    private final WeakReference<ClassLoader> cl;
    private final ConcurrentMap<QName, NamespaceParserPair> parserMappings;
+   private final Properties properties;
 
    public ParserRegistry() {
       this(Thread.currentThread().getContextClassLoader());
    }
 
    public ParserRegistry(ClassLoader classLoader) {
-      this(classLoader, false);
+      this(classLoader, false, SecurityActions.getSystemProperties());
    }
 
-   public ParserRegistry(ClassLoader classLoader, boolean defaultOnly) {
+   public ParserRegistry(ClassLoader classLoader, boolean defaultOnly, Properties properties) {
       this.parserMappings = CollectionFactory.makeConcurrentMap();
       this.cl = new WeakReference<>(classLoader);
+      this.properties = properties;
       Collection<ConfigurationParser> parsers = ServiceFinder.load(ConfigurationParser.class, cl.get(), ParserRegistry.class.getClassLoader());
       for (ConfigurationParser parser : parsers) {
 
@@ -130,10 +133,19 @@ public ConfigurationBuilderHolder parse(InputStream is) {
       }
    }
 
+   private void setIfSupported(final XMLInputFactory inputFactory, final String property, final Object value) {
+      if (inputFactory.isPropertySupported(property)) {
+         inputFactory.setProperty(property, value);
+      }
+   }
+
    public void parse(InputStream is, ConfigurationBuilderHolder holder) throws XMLStreamException {
       BufferedInputStream input = new BufferedInputStream(is);
-      XMLStreamReader subReader = XMLInputFactory.newInstance().createXMLStreamReader(input);
-      XMLExtendedStreamReader reader = new XMLExtendedStreamReaderImpl(this, subReader);
+      XMLInputFactory factory = XMLInputFactory.newInstance();
+      setIfSupported(factory, XMLInputFactory.IS_VALIDATING, Boolean.FALSE);
+      setIfSupported(factory, XMLInputFactory.SUPPORT_DTD, Boolean.FALSE);
+      XMLStreamReader subReader = factory.createXMLStreamReader(input);
+      XMLExtendedStreamReader reader = new XMLExtendedStreamReaderImpl(this, subReader, properties);
       parse(reader, holder);
       subReader.close();
       // Fire all parsingComplete events if any

core/src/main/java/org/infinispan/configuration/parsing/SecurityActions.java

@@ -0,0 +1,32 @@
+package org.infinispan.configuration.parsing;
+
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+import java.util.Properties;
+
+import org.infinispan.security.Security;
+
+/**
+ * SecurityActions for the org.infinispan.configuration.parsing
+ *
+ * Do not move. Do not change class and method visibility to avoid being called from other
+ * {@link java.security.CodeSource}s, thus granting privilege escalation to external code.
+ *
+ * @author Tristan Tarrant
+ * @since 10.0
+ */
+final class SecurityActions {
+   private static <T> T doPrivileged(PrivilegedAction<T> action) {
+      if (System.getSecurityManager() != null) {
+         return AccessController.doPrivileged(action);
+      } else {
+         return Security.doPrivileged(action);
+      }
+   }
+
+   static Properties getSystemProperties() {
+      return doPrivileged(() -> System.getProperties());
+   }
+
+
+}

core/src/main/java/org/infinispan/configuration/parsing/XMLExtendedStreamReaderImpl.java

@@ -2,13 +2,16 @@
 
 import java.util.ArrayDeque;
 import java.util.Deque;
+import java.util.Properties;
 
 import javax.xml.namespace.NamespaceContext;
 import javax.xml.namespace.QName;
 import javax.xml.stream.Location;
 import javax.xml.stream.XMLStreamException;
 import javax.xml.stream.XMLStreamReader;
 
+import static org.infinispan.commons.util.StringPropertyReplacer.replaceProperties;
+
 /**
  * @author <a href="mailto:david.lloyd@redhat.com">David M. Lloyd</a>
  * @author Tristan Tarrant
@@ -20,10 +23,12 @@ final class XMLExtendedStreamReaderImpl implements XMLExtendedStreamReader {
    private final XMLStreamReader streamReader;
    private final Deque<Context> stack = new ArrayDeque<Context>();
    private Schema schema;
+   private Properties properties;
 
-   XMLExtendedStreamReaderImpl(final NamespaceMappingParser parser, final XMLStreamReader streamReader) {
+   XMLExtendedStreamReaderImpl(final NamespaceMappingParser parser, final XMLStreamReader streamReader, Properties properties) {
       this.parser = parser;
       this.streamReader = streamReader;
+      this.properties = properties;
       stack.push(new Context());
    }
 
@@ -79,7 +84,8 @@ public void require(final int type, final String namespaceURI, final String loca
 
    @Override
    public String getElementText() throws XMLStreamException {
-      return streamReader.getElementText().trim();
+      String text = streamReader.getElementText().trim();
+      return replaceProperties(text, properties);
    }
 
    @Override
@@ -139,7 +145,8 @@ public boolean isWhiteSpace() {
 
    @Override
    public String getAttributeValue(final String namespaceURI, final String localName) {
-      return streamReader.getAttributeValue(namespaceURI, localName);
+      String value = streamReader.getAttributeValue(namespaceURI, localName);
+      return replaceProperties(value, properties);
    }
 
    @Override
@@ -174,7 +181,8 @@ public String getAttributeType(final int index) {
 
    @Override
    public String getAttributeValue(final int index) {
-      return streamReader.getAttributeValue(index);
+      String value = streamReader.getAttributeValue(index);
+      return replaceProperties(value, properties);
    }
 
    @Override

core/src/test/java/org/infinispan/configuration/StringPropertyReplacementTest.java

@@ -24,12 +24,13 @@
 public class StringPropertyReplacementTest extends AbstractInfinispanTest {
 
    protected ConfigurationBuilderHolder parse() throws Exception {
-      System.setProperty("StringPropertyReplacementTest.asyncListenerMaxThreads","2");
-      System.setProperty("StringPropertyReplacementTest.persistenceMaxThreads","4");
-      System.setProperty("StringPropertyReplacementTest.IsolationLevel","READ_COMMITTED");
-      System.setProperty("StringPropertyReplacementTest.writeSkewCheck","true");
-      System.setProperty("StringPropertyReplacementTest.SyncCommitPhase","true");
-      ParserRegistry parserRegistry = new ParserRegistry(Thread.currentThread().getContextClassLoader(), true);
+      Properties properties = new Properties();
+      properties.setProperty("StringPropertyReplacementTest.asyncListenerMaxThreads","2");
+      properties.setProperty("StringPropertyReplacementTest.persistenceMaxThreads","4");
+      properties.setProperty("StringPropertyReplacementTest.IsolationLevel","READ_COMMITTED");
+      properties.setProperty("StringPropertyReplacementTest.writeSkewCheck","true");
+      properties.setProperty("StringPropertyReplacementTest.SyncCommitPhase","true");
+      ParserRegistry parserRegistry = new ParserRegistry(Thread.currentThread().getContextClassLoader(), true, properties);
       return parserRegistry.parseFile("configs/string-property-replaced.xml");
    }
 

core/src/test/java/org/infinispan/configuration/XmlFileParsingTest.java

@@ -18,6 +18,7 @@
 import org.infinispan.commons.CacheConfigurationException;
 import org.infinispan.commons.equivalence.AnyEquivalence;
 import org.infinispan.commons.executors.BlockingThreadPoolExecutorFactory;
+import org.infinispan.commons.jmx.PerThreadMBeanServerLookup;
 import org.infinispan.commons.marshall.AdvancedExternalizer;
 import org.infinispan.commons.marshall.jboss.GenericJBossMarshaller;
 import org.infinispan.configuration.cache.AbstractStoreConfiguration;
@@ -37,7 +38,6 @@
 import org.infinispan.eviction.EvictionType;
 import org.infinispan.factories.threads.DefaultThreadFactory;
 import org.infinispan.interceptors.FooInterceptor;
-import org.infinispan.commons.jmx.PerThreadMBeanServerLookup;
 import org.infinispan.marshall.AdvancedExternalizerTest;
 import org.infinispan.marshall.TestObjectStreamMarshaller;
 import org.infinispan.marshall.core.MarshalledEntry;
@@ -66,7 +66,7 @@ public void testFailOnUnexpectedConfigurationFile() throws IOException {
    }
 
    public void testNamedCacheFile() throws IOException {
-      ParserRegistry parserRegistry = new ParserRegistry(Thread.currentThread().getContextClassLoader(), true);
+      ParserRegistry parserRegistry = new ParserRegistry(Thread.currentThread().getContextClassLoader(), true, System.getProperties());
       ConfigurationBuilderHolder holder = parserRegistry.parseFile("configs/named-cache-test.xml");
       assertNamedCacheFile(holder, false);
    }

core/src/test/java/org/infinispan/configuration/module/MyParserExtension.java

@@ -1,7 +1,5 @@
 package org.infinispan.configuration.module;
 
-import static org.infinispan.commons.util.StringPropertyReplacer.replaceProperties;
-
 import javax.xml.stream.XMLStreamException;
 
 import org.infinispan.configuration.cache.ConfigurationBuilder;
@@ -45,7 +43,7 @@ private void parseSampleElement(XMLExtendedStreamReader reader, MyModuleConfigur
          throws XMLStreamException {
       for (int i = 0; i < reader.getAttributeCount(); i++) {
          ParseUtils.requireNoNamespaceAttribute(reader, i);
-         String value = replaceProperties(reader.getAttributeValue(i));
+         String value = reader.getAttributeValue(i);
          Attribute attribute = Attribute.forName(reader.getAttributeLocalName(i));
          switch (attribute) {
          case SAMPLE_ATTRIBUTE: {

core/src/test/java/org/infinispan/configuration/parsing/UnifiedXmlFileParsingTest.java

@@ -14,6 +14,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.NoSuchElementException;
+import java.util.Properties;
 import java.util.stream.Collectors;
 
 import org.infinispan.Version;
@@ -95,7 +96,9 @@ public void testParseAndConstructUnifiedXmlFile(Path config) throws IOException
       int major = Integer.parseInt(parts[0]);
       int minor = Integer.parseInt(parts[1]);
 
-      ParserRegistry parserRegistry = new ParserRegistry(Thread.currentThread().getContextClassLoader(), false);
+      Properties properties = new Properties();
+
+      ParserRegistry parserRegistry = new ParserRegistry(Thread.currentThread().getContextClassLoader(), false, properties);
       try (InputStream is = FileLookupFactory.newInstance().lookupFileStrict(config.toString(), Thread.currentThread().getContextClassLoader())) {
          ConfigurationBuilderHolder holder = parserRegistry.parse(is);
          for(ParserVersionCheck check : ParserVersionCheck.values()) {

core/src/test/java/org/infinispan/test/fwk/TestCacheManagerFactory.java

@@ -112,7 +112,7 @@ public static EmbeddedCacheManager fromStream(InputStream is, boolean keepJmxDom
    }
 
    public static EmbeddedCacheManager fromStream(InputStream is, boolean keepJmxDomainName, boolean defaultParsersOnly, boolean start) throws IOException {
-      ParserRegistry parserRegistry = new ParserRegistry(Thread.currentThread().getContextClassLoader(), defaultParsersOnly);
+      ParserRegistry parserRegistry = new ParserRegistry(Thread.currentThread().getContextClassLoader(), defaultParsersOnly, System.getProperties());
       ConfigurationBuilderHolder holder = parserRegistry.parse(is);
 
       // The node name is set in each DefaultThreadFactory individually, override it here

counter/src/main/java/org/infinispan/counter/configuration/CounterConfigurationParser.java

@@ -2,7 +2,6 @@
 
 import static javax.xml.stream.XMLStreamConstants.START_DOCUMENT;
 import static javax.xml.stream.XMLStreamConstants.START_ELEMENT;
-import static org.infinispan.commons.util.StringPropertyReplacer.replaceProperties;
 
 import java.io.BufferedInputStream;
 import java.io.InputStream;
@@ -98,7 +97,7 @@ private void parseCountersElement(XMLStreamReader reader, CounterManagerConfigur
          throws XMLStreamException {
       for (int i = 0; i < reader.getAttributeCount(); i++) {
          ParseUtils.requireNoNamespaceAttribute(reader, i);
-         String value = replaceProperties(reader.getAttributeValue(i));
+         String value = reader.getAttributeValue(i);
          Attribute attribute = Attribute.forName(reader.getAttributeLocalName(i));
          switch (attribute) {
             case NUM_OWNERS:
@@ -130,7 +129,7 @@ private void parseWeakCounter(XMLStreamReader reader, WeakCounterConfigurationBu
          throws XMLStreamException {
       for (int i = 0; i < reader.getAttributeCount(); i++) {
          ParseUtils.requireNoNamespaceAttribute(reader, i);
-         String value = replaceProperties(reader.getAttributeValue(i));
+         String value = reader.getAttributeValue(i);
          Attribute attribute = Attribute.forName(reader.getAttributeLocalName(i));
          switch (attribute) {
             case CONCURRENCY_LEVEL:
@@ -147,7 +146,7 @@ private void parseStrongCounter(XMLStreamReader reader, StrongCounterConfigurati
          throws XMLStreamException {
       for (int i = 0; i < reader.getAttributeCount(); i++) {
          ParseUtils.requireNoNamespaceAttribute(reader, i);
-         String value = replaceProperties(reader.getAttributeValue(i));
+         String value = reader.getAttributeValue(i);
          Attribute attribute = Attribute.forName(reader.getAttributeLocalName(i));
          parserCommonCounterAttributes(reader, builder, i, attribute, value);
       }
@@ -170,7 +169,7 @@ private void parseUpperBound(XMLStreamReader reader, StrongCounterConfigurationB
          throws XMLStreamException {
       for (int i = 0; i < reader.getAttributeCount(); i++) {
          ParseUtils.requireNoNamespaceAttribute(reader, i);
-         String value = replaceProperties(reader.getAttributeValue(i));
+         String value = reader.getAttributeValue(i);
          Attribute attribute = Attribute.forName(reader.getAttributeLocalName(i));
          switch (attribute) {
             case VALUE:
@@ -187,7 +186,7 @@ private void parseLowerBound(XMLStreamReader reader, StrongCounterConfigurationB
          throws XMLStreamException {
       for (int i = 0; i < reader.getAttributeCount(); i++) {
          ParseUtils.requireNoNamespaceAttribute(reader, i);
-         String value = replaceProperties(reader.getAttributeValue(i));
+         String value = reader.getAttributeValue(i);
          Attribute attribute = Attribute.forName(reader.getAttributeLocalName(i));
          switch (attribute) {
             case VALUE:

persistence/cli/src/main/java/org/infinispan/persistence/cli/configuration/CLInterfaceLoaderConfigurationParser.java

@@ -1,7 +1,5 @@
 package org.infinispan.persistence.cli.configuration;
 
-import static org.infinispan.commons.util.StringPropertyReplacer.replaceProperties;
-
 import javax.xml.stream.XMLStreamException;
 
 import org.infinispan.configuration.cache.ConfigurationBuilder;
@@ -56,7 +54,7 @@ private void parseCliLoaderAttributes(XMLExtendedStreamReader reader,
          throws XMLStreamException  {
       for (int i = 0; i < reader.getAttributeCount(); i++) {
          ParseUtils.requireNoNamespaceAttribute(reader, i);
-         String value = replaceProperties(reader.getAttributeValue(i));
+         String value = reader.getAttributeValue(i);
          String attrName = reader.getAttributeLocalName(i);
          Attribute attribute = Attribute.forName(attrName);
          switch (attribute) {

persistence/jdbc/src/main/java/org/infinispan/persistence/jdbc/configuration/JdbcStoreConfigurationParser.java

@@ -1,7 +1,5 @@
 package org.infinispan.persistence.jdbc.configuration;
 
-import static org.infinispan.commons.util.StringPropertyReplacer.replaceProperties;
-
 import javax.xml.stream.XMLStreamConstants;
 import javax.xml.stream.XMLStreamException;
 
@@ -62,7 +60,7 @@ private void parseStringKeyedJdbcStore(final XMLExtendedStreamReader reader,
       JdbcStringBasedStoreConfigurationBuilder builder = new JdbcStringBasedStoreConfigurationBuilder(
             persistenceBuilder);
       for (int i = 0; i < reader.getAttributeCount(); i++) {
-         String value = replaceProperties(reader.getAttributeValue(i));
+         String value = reader.getAttributeValue(i);
          Attribute attribute = Attribute.forName(reader.getAttributeLocalName(i));
          switch (attribute) {
             case KEY_TO_STRING_MAPPER:
@@ -121,7 +119,7 @@ private void parseConnectionPoolAttributes(XMLExtendedStreamReader reader,
                                               PooledConnectionFactoryConfigurationBuilder<?> builder) throws XMLStreamException {
       for (int i = 0; i < reader.getAttributeCount(); i++) {
          ParseUtils.requireNoNamespaceAttribute(reader, i);
-         String value = replaceProperties(reader.getAttributeValue(i));
+         String value = reader.getAttributeValue(i);
          Attribute attribute = Attribute.forName(reader.getAttributeLocalName(i));
          switch (attribute) {
             case PROPERTIES_FILE: {
@@ -156,7 +154,7 @@ private void parseSimpleConnectionAttributes(XMLExtendedStreamReader reader,
                                                 SimpleConnectionFactoryConfigurationBuilder<?> builder) throws XMLStreamException {
       for (int i = 0; i < reader.getAttributeCount(); i++) {
          ParseUtils.requireNoNamespaceAttribute(reader, i);
-         String value = replaceProperties(reader.getAttributeValue(i));
+         String value = reader.getAttributeValue(i);
          Attribute attribute = Attribute.forName(reader.getAttributeLocalName(i));
          switch (attribute) {
             case CONNECTION_URL: {
@@ -187,7 +185,7 @@ private void parseTable(XMLExtendedStreamReader reader, TableManipulationConfigu
          throws XMLStreamException {
       for (int i = 0; i < reader.getAttributeCount(); i++) {
          ParseUtils.requireNoNamespaceAttribute(reader, i);
-         String value = replaceProperties(reader.getAttributeValue(i));
+         String value = reader.getAttributeValue(i);
          Attribute attribute = Attribute.forName(reader.getAttributeLocalName(i));
          switch (attribute) {
             case BATCH_SIZE: {

persistence/jpa/src/main/java/org/infinispan/persistence/jpa/configuration/JpaStoreConfigurationParser.java

@@ -3,7 +3,6 @@
 import javax.xml.stream.XMLStreamConstants;
 import javax.xml.stream.XMLStreamException;
 
-import org.infinispan.commons.util.StringPropertyReplacer;
 import org.infinispan.commons.util.Util;
 import org.infinispan.configuration.cache.ConfigurationBuilder;
 import org.infinispan.configuration.parsing.ConfigurationBuilderHolder;
@@ -43,7 +42,7 @@ private void parseJpaCacheStore(XMLExtendedStreamReader reader, JpaStoreConfigur
          throws XMLStreamException {
       for (int i = 0; i < reader.getAttributeCount(); i++) {
          ParseUtils.requireNoNamespaceAttribute(reader, i);
-         String value = StringPropertyReplacer.replaceProperties(reader.getAttributeValue(i));
+         String value = reader.getAttributeValue(i);
          Attribute attribute = Attribute.forName(reader.getAttributeLocalName(i));
 
          switch (attribute) {

persistence/leveldb/src/main/java/org/infinispan/persistence/leveldb/configuration/LevelDBStoreConfigurationParser.java

@@ -3,7 +3,6 @@
 import javax.xml.stream.XMLStreamConstants;
 import javax.xml.stream.XMLStreamException;
 
-import org.infinispan.commons.util.StringPropertyReplacer;
 import org.infinispan.configuration.cache.ConfigurationBuilder;
 import org.infinispan.configuration.parsing.ConfigurationBuilderHolder;
 import org.infinispan.configuration.parsing.ConfigurationParser;
@@ -52,8 +51,7 @@ public void readElement(XMLExtendedStreamReader reader, ConfigurationBuilderHold
    private void parseLevelDBCacheStore(XMLExtendedStreamReader reader, LevelDBStoreConfigurationBuilder builder) throws XMLStreamException {
       for (int i = 0; i < reader.getAttributeCount(); i++) {
          ParseUtils.requireNoNamespaceAttribute(reader, i);
-         String attributeValue = reader.getAttributeValue(i);
-         String value = StringPropertyReplacer.replaceProperties(attributeValue);
+         String value = reader.getAttributeValue(i);
          String attrName = reader.getAttributeLocalName(i);
          Attribute attribute = Attribute.forName(attrName);
 
@@ -108,8 +106,7 @@ private void parseLevelDBCacheStore(XMLExtendedStreamReader reader, LevelDBStore
 
    private void parseLevelDBCacheStoreExpiry(XMLExtendedStreamReader reader, LevelDBStoreConfigurationBuilder builder) throws XMLStreamException {
       for (int i = 0; i < reader.getAttributeCount(); i++) {
-         String attributeValue = reader.getAttributeValue(i);
-         String value = StringPropertyReplacer.replaceProperties(attributeValue);
+         String value = reader.getAttributeValue(i);
          Attribute attribute = Attribute.forName(reader.getAttributeLocalName(i));
          switch (attribute) {
             case PATH: {