ESB-1146 XML Injection

admin-console/src/test/config/conf/systemParams.properties

@@ -81,3 +81,7 @@ db.environment=test
 
 oauth2.accessToken.validitySeconds=3600
 oauth2.refreshToken.validitySeconds=86400
+
+##----------------------
+## Keycloak configuration
+keycloak.enabled=false

cds-plugin/src/test/config/conf/systemParams.properties

@@ -90,3 +90,7 @@ oauth2.refreshToken.validitySeconds=86400
 cds.public.url=${CDS_PUBLIC_URL:https://cds.sme.entando.org}
 cds.private.url=${CDS_PRIVATE_URL:https://cds.sme.entando.org}
 cds.path=${CDS_PATH:/api/v1}
+
+##----------------------
+## Keycloak configuration
+keycloak.enabled=false

cms-plugin/src/main/java/com/agiletec/plugins/jacms/aps/system/services/resource/parse/ImageDimensionDOM.java

@@ -21,6 +21,7 @@
 
 import org.jdom2.Document;
 import org.jdom2.Element;
+import org.entando.entando.ent.util.EntSafeXmlUtils;
 import org.jdom2.input.SAXBuilder;
 import org.entando.entando.ent.util.EntLogging.EntLogger;
 import org.entando.entando.ent.util.EntLogging.EntLogFactory;
@@ -85,7 +86,7 @@ public Map<Integer, ImageResourceDimension> getDimensions() {
 	}
 
 	private void decodeDOM(String xmlText) throws EntException {
-		SAXBuilder builder = new SAXBuilder();
+		SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder();
 		builder.setValidation(false);
 		StringReader reader = new StringReader(xmlText);
 		try {

cms-plugin/src/test/config/conf/systemParams.properties

@@ -83,3 +83,7 @@ db.environment=test
 
 oauth2.accessToken.validitySeconds=3600
 oauth2.refreshToken.validitySeconds=86400
+
+##----------------------
+## Keycloak configuration
+keycloak.enabled=false

contentscheduler-plugin/src/main/java/org/entando/entando/plugins/jpcontentscheduler/aps/system/services/content/parse/ContentThreadConfigDOM.java

@@ -39,6 +39,7 @@
 import org.jdom2.Document;
 import org.jdom2.Element;
 import org.jdom2.JDOMException;
+import org.entando.entando.ent.util.EntSafeXmlUtils;
 import org.jdom2.input.SAXBuilder;
 import org.jdom2.output.XMLOutputter;
 
@@ -444,7 +445,7 @@ private Element createMailElement(ContentThreadConfig config) {
 	 * In case of parsing exceptions.
 	 */
 	private Element getRootElement(String xmlText) throws EntException {
-		SAXBuilder builder = new SAXBuilder();
+		SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder();
 		builder.setValidation(false);
 		StringReader reader = new StringReader(xmlText);
 		Element root = null;

contentscheduler-plugin/src/test/config/conf/systemParams.properties

@@ -83,3 +83,7 @@ db.environment=test
 
 oauth2.accessToken.validitySeconds=3600
 oauth2.refreshToken.validitySeconds=86400
+
+##----------------------
+## Keycloak configuration
+keycloak.enabled=false

contentworkflow-plugin/src/main/java/com/agiletec/plugins/jpcontentworkflow/aps/system/services/notifier/parse/WorkflowNotifierDOM.java

@@ -1,3 +1,3 @@
 /*
  * Copyright 2015-Present Entando Inc. (http://www.entando.com) All rights reserved.
  *
@@ -30,6 +30,7 @@
 import org.jdom2.CDATA;
 import org.jdom2.Document;
 import org.jdom2.Element;
+import org.entando.entando.ent.util.EntSafeXmlUtils;
 import org.jdom2.input.SAXBuilder;
 import org.jdom2.output.XMLOutputter;
 
@@ -135,7 +136,7 @@
 	}
 
 	protected Element getRootElement(String xmlText) throws ApsSystemException {
-		SAXBuilder builder = new SAXBuilder();
+		SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder();
 		builder.setValidation(false);
 		StringReader reader = new StringReader(xmlText);
 		Element root = null;
@@ -150,7 +151,7 @@
 	}
 
 	protected Document decodeDOM(String xmlText) throws ApsSystemException {
-		SAXBuilder builder = new SAXBuilder();
+		SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder();
 		builder.setValidation(false);
 		StringReader reader = new StringReader(xmlText);
 		try {

contentworkflow-plugin/src/main/java/com/agiletec/plugins/jpcontentworkflow/aps/system/services/workflow/parse/ContentWorkflowDOM.java

@@ -31,6 +31,7 @@
 import java.util.Map;
 import org.jdom2.Document;
 import org.jdom2.Element;
+import org.entando.entando.ent.util.EntSafeXmlUtils;
 import org.jdom2.input.SAXBuilder;
 import org.jdom2.output.Format;
 import org.jdom2.output.XMLOutputter;
@@ -129,7 +130,7 @@ protected Element createStepElement(Step step) {
 	}
 
 	protected Element getRootElement(String xmlText) throws ApsSystemException {
-		SAXBuilder builder = new SAXBuilder();
+		SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder();
 		builder.setValidation(false);
 		StringReader reader = new StringReader(xmlText);
 		Element root = null;

contentworkflow-plugin/src/test/config/conf/systemParams.properties

@@ -78,3 +78,7 @@ db.environment=test
 
 oauth2.accessToken.validitySeconds=3600
 oauth2.refreshToken.validitySeconds=86400
+
+##----------------------
+## Keycloak configuration
+keycloak.enabled=false

engine/src/main/java/com/agiletec/aps/system/common/entity/parse/AbstractAttributeSupportObjectDOM.java

@@ -73,7 +73,7 @@ protected void validate(String xmlText, String definitionPath) throws EntExcepti
 
 	protected Document decodeDOM(String xmlText) throws EntException {
 		Document doc = null;
-		SAXBuilder builder = new SAXBuilder();
+		SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder();
 		builder.setValidation(false);
 		StringReader reader = new StringReader(xmlText);
 		try {

engine/src/main/java/com/agiletec/aps/system/common/entity/parse/EntityTypeDOM.java

@@ -22,6 +22,7 @@
 
 import org.jdom2.Document;
 import org.jdom2.Element;
+import org.entando.entando.ent.util.EntSafeXmlUtils;
 import org.jdom2.input.SAXBuilder;
 import org.jdom2.output.Format;
 import org.jdom2.output.XMLOutputter;
@@ -183,7 +184,7 @@ protected Element createRootTypeElement(IApsEntity currentEntityType) {
 
 	private Document decodeDOM(String xmlText) throws EntException {
 		Document doc = null;
-		SAXBuilder builder = new SAXBuilder();
+		SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder();
 		builder.setValidation(false);
 		StringReader reader = new StringReader(xmlText);
 		try {

engine/src/main/java/com/agiletec/aps/system/services/baseconfig/SystemParamsUtils.java

@@ -21,6 +21,7 @@
 
 import org.jdom2.Document;
 import org.jdom2.Element;
+import org.entando.entando.ent.util.EntSafeXmlUtils;
 import org.jdom2.input.SAXBuilder;
 import org.jdom2.output.Format;
 import org.jdom2.output.XMLOutputter;
@@ -148,7 +149,7 @@ private static Element searchParamElement(Element currentElement, String paramNa
     private static Document decodeDOM(String xmlText) throws EntException {
         Document doc = null;
         try {
-            SAXBuilder builder = new SAXBuilder();
+            SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder();
             builder.setValidation(false);
             StringReader reader = new StringReader(xmlText);
             doc = builder.build(reader);

engine/src/main/java/com/agiletec/aps/system/services/lang/LangDOM.java

@@ -19,6 +19,7 @@
 
 import org.jdom2.Document;
 import org.jdom2.Element;
+import org.entando.entando.ent.util.EntSafeXmlUtils;
 import org.jdom2.input.SAXBuilder;
 import org.jdom2.output.Format;
 import org.jdom2.output.XMLOutputter;
@@ -127,7 +128,7 @@ public String getXMLDocument(){
 	}
 
 	private void decodeDOM(String xmlText) throws EntException {
-		SAXBuilder builder = new SAXBuilder();
+		SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder();
 		builder.setValidation(false);
 		StringReader reader = new StringReader(xmlText);
 		try {

engine/src/main/java/com/agiletec/aps/system/services/page/PageExtraConfigDOM.java

@@ -20,6 +20,7 @@
 
 import org.jdom2.Document;
 import org.jdom2.Element;
+import org.entando.entando.ent.util.EntSafeXmlUtils;
 import org.jdom2.input.SAXBuilder;
 import org.jdom2.output.Format;
 import org.jdom2.output.XMLOutputter;
@@ -112,7 +113,7 @@ protected void fillDocument(Document doc, PageMetadata page) {
 
 	private Document decodeDOM(String xml) throws EntException {
 		Document doc = null;
-		SAXBuilder builder = new SAXBuilder();
+		SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder();
 		builder.setValidation(false);
 		StringReader reader = new StringReader(xml);
 		try {

engine/src/main/java/com/agiletec/aps/system/services/pagemodel/PageModelDOM.java

@@ -28,6 +28,7 @@
 
 import org.jdom2.Document;
 import org.jdom2.Element;
+import org.entando.entando.ent.util.EntSafeXmlUtils;
 import org.jdom2.input.SAXBuilder;
 import org.jdom2.output.Format;
 import org.jdom2.output.XMLOutputter;
@@ -107,13 +108,13 @@ private Element buildSketchXML(Frame frame) {
 	}
 
 	private void decodeDOM(String xmlText) throws EntException {
-		SAXBuilder builder = new SAXBuilder();
+		SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder();
 		builder.setValidation(false);
 		StringReader reader = new StringReader(xmlText);
 		try {
 			_doc = builder.build(reader);
 		} catch (Throwable t) {
-			_logger.error("Error parsing the page template XML: {}", xmlText, t);
+			_logger.error("Error parsing the page template XML", t);
 			throw new EntException("Error parsing the page template XML", t);
 		}
 	}

engine/src/main/java/com/agiletec/aps/util/ApsPropertiesDOM.java

@@ -20,6 +20,7 @@
 
 import org.jdom2.Document;
 import org.jdom2.Element;
+import org.entando.entando.ent.util.EntSafeXmlUtils;
 import org.jdom2.input.SAXBuilder;
 import org.jdom2.output.Format;
 import org.jdom2.output.XMLOutputter;
@@ -80,7 +81,7 @@ public Element getRootElement() {
 	}
 
 	private void decodeDOM(String xmlText) {
-		SAXBuilder builder = new SAXBuilder();
+		SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder();
 		builder.setValidation(false);
 		StringReader reader = new StringReader(xmlText);
 		try {

engine/src/main/java/org/entando/entando/aps/system/init/model/DataSourceDumpReport.java

@@ -1,3 +1,3 @@
 /*
  * Copyright 2015-Present Entando S.r.l. (http://www.entando.com) All rights reserved.
  *
@@ -24,6 +24,7 @@
 import org.apache.commons.beanutils.BeanComparator;
 import org.jdom2.Document;
 import org.jdom2.Element;
+import org.entando.entando.ent.util.EntSafeXmlUtils;
 import org.jdom2.input.SAXBuilder;
 import org.jdom2.output.Format;
 import org.jdom2.output.XMLOutputter;
@@ -51,7 +52,7 @@
 		if (null == xmlText || xmlText.trim().length() == 0) {
 			return;
 		}
-		SAXBuilder builder = new SAXBuilder();
+		SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder();
 		builder.setValidation(false);
 		StringReader reader = new StringReader(xmlText);
 		try {

engine/src/main/java/org/entando/entando/aps/system/init/model/SystemInstallationReport.java

@@ -1,3 +1,3 @@
 /*
  * Copyright 2015-Present Entando S.r.l. (http://www.entando.com) All rights reserved.
  *
@@ -20,6 +20,7 @@
 
 import org.jdom2.Document;
 import org.jdom2.Element;
+import org.entando.entando.ent.util.EntSafeXmlUtils;
 import org.jdom2.input.SAXBuilder;
 import org.jdom2.output.Format;
 import org.jdom2.output.XMLOutputter;
@@ -72,7 +73,7 @@
             this.setStatus(Status.PORTING);
             return;
         }
-        SAXBuilder builder = new SAXBuilder();
+        SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder();
         builder.setValidation(false);
         StringReader reader = new StringReader(xmlText);
         try {

engine/src/main/java/org/entando/entando/aps/system/init/util/ComponentDefDOM.java

@@ -93,7 +93,7 @@ protected Component getComponent(Map<String, String> postProcessClasses) {
     }
 
     private void decodeDOM(String xmlText) throws EntException {
-        SAXBuilder builder = new SAXBuilder();
+        SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder();
         builder.setValidation(false);
         StringReader reader = new StringReader(xmlText);
         try {

engine/src/main/java/org/entando/entando/aps/system/services/api/ApiResourcesDefDOM.java

@@ -166,7 +166,7 @@ private void checkMethod(ApiMethod apiMethod, ApiResource resource) {
     }
 
     private void decodeDOM(String xmlText) throws EntException {
-        SAXBuilder builder = new SAXBuilder();
+        SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder();
         builder.setValidation(false);
         StringReader reader = new StringReader(xmlText);
         try {

engine/src/main/java/org/entando/entando/aps/system/services/api/ServiceExtraConfigDOM.java

@@ -18,6 +18,7 @@
 
 import org.jdom2.Document;
 import org.jdom2.Element;
+import org.entando.entando.ent.util.EntSafeXmlUtils;
 import org.jdom2.input.SAXBuilder;
 import org.jdom2.output.Format;
 import org.jdom2.output.XMLOutputter;
@@ -62,7 +63,7 @@ protected String[] extractFreeParameters() {
     }
 
     private void decodeDOM(String xml) throws EntException {
-        SAXBuilder builder = new SAXBuilder();
+        SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder();
         builder.setValidation(false);
         StringReader reader = new StringReader(xml);
         try {

engine/src/main/java/org/entando/entando/aps/system/services/widgettype/WidgetTypeDOM.java

@@ -20,6 +20,7 @@
 
 import org.jdom2.Document;
 import org.jdom2.Element;
+import org.entando.entando.ent.util.EntSafeXmlUtils;
 import org.jdom2.input.SAXBuilder;
 import org.jdom2.output.Format;
 import org.jdom2.output.XMLOutputter;
@@ -142,7 +143,7 @@ public String getXMLDocument(){
 	}
 
 	private void decodeDOM(String xmlText) throws EntException {
-		SAXBuilder builder = new SAXBuilder();
+		SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder();
 		builder.setValidation(false);
 		StringReader reader = new StringReader(xmlText);
 		try {

engine/src/main/java/org/entando/entando/ent/util/EntSafeXmlUtils.java

@@ -15,6 +15,7 @@
 package org.entando.entando.ent.util;
 
 import org.entando.entando.ent.exception.EntRuntimeException;
+import org.jdom2.input.SAXBuilder;
 import org.xml.sax.SAXException;
 import org.xml.sax.SAXNotRecognizedException;
 import org.xml.sax.SAXNotSupportedException;
@@ -41,6 +42,7 @@ public class EntSafeXmlUtils {
     private static final String HTTP_XML_ORG_SAX_FEATURES_EXTERNAL_PARAMETER_ENTITIES = "http://xml.org/sax/features/external-parameter-entities";
     private static final String HTTP_APACHE_ORG_XML_FEATURES_NONVALIDATING_LOAD_EXTERNAL_DTD = "http://apache.org/xml/features/nonvalidating/load-external-dtd";
     public static final String XMLSCHEMA_FACTORY_CLASS = "com.sun.org.apache.xerces.internal.jaxp.validation.XMLSchemaFactory";
+    public static final String HTTP_APACHE_ORG_XML_FEATURES_DISALLOW_DOCTYPE_DECL = "http://apache.org/xml/features/disallow-doctype-decl";
 
     private static SAXParserFactory newSaxParserFactory() {
         SAXParserFactory parseFactory = SAXParserFactory.newInstance();
@@ -76,6 +78,16 @@ public static Schema newSafeSchema(String schemaLanguage, InputStream resourceAs
         return factory.newSchema(schemaSource);
     }
 
+    public static SAXBuilder newSafeSAXBuilder() {
+        SAXBuilder builder = new SAXBuilder();
+        builder.setFeature(HTTP_APACHE_ORG_XML_FEATURES_DISALLOW_DOCTYPE_DECL, true);
+        builder.setFeature(HTTP_XML_ORG_SAX_FEATURES_EXTERNAL_GENERAL_ENTITIES, false);
+        builder.setFeature(HTTP_XML_ORG_SAX_FEATURES_EXTERNAL_PARAMETER_ENTITIES, false);
+        builder.setFeature(HTTP_APACHE_ORG_XML_FEATURES_NONVALIDATING_LOAD_EXTERNAL_DTD, false);
+        builder.setExpandEntities(false);
+        return builder;
+    }
+
     private EntSafeXmlUtils() {
     }
 }

engine/src/test/config/conf/systemParams.properties

@@ -103,3 +103,7 @@ entando.liquibase.lock.fallback.minutes=5
 
 # CSP Header configuration
 CSP_HEADER_ENABLED=false
+
+##----------------------
+## Keycloak configuration
+keycloak.enabled=false

keycloak-plugin/src/test/config/conf/systemParams.properties

@@ -81,3 +81,7 @@ db.environment=test
 
 oauth2.accessToken.validitySeconds=3600
 oauth2.refreshToken.validitySeconds=86400
+
+##----------------------
+## Keycloak configuration
+keycloak.enabled=false

mail-plugin/src/main/java/com/agiletec/plugins/jpmail/aps/services/mail/parse/MailConfigDOM.java

@@ -28,6 +28,7 @@
 import org.jdom2.Document;
 import org.jdom2.Element;
 import org.jdom2.JDOMException;
+import org.entando.entando.ent.util.EntSafeXmlUtils;
 import org.jdom2.input.SAXBuilder;
 import org.jdom2.output.Format;
 import org.jdom2.output.XMLOutputter;
@@ -248,7 +249,7 @@ private Element createSmtpElement(MailConfig config) {
 	 * @throws EntException In case of parsing exceptions.
 	 */
 	private Element getRootElement(String xmlText) throws EntException {
-		SAXBuilder builder = new SAXBuilder();
+		SAXBuilder builder = EntSafeXmlUtils.newSafeSAXBuilder();
 		builder.setValidation(false);
 		StringReader reader = new StringReader(xmlText);
 		Element root = null;

mail-plugin/src/test/config/conf/systemParams.properties

@@ -80,3 +80,7 @@ db.environment=test
 
 oauth2.accessToken.validitySeconds=3600
 oauth2.refreshToken.validitySeconds=86400
+
+##----------------------
+## Keycloak configuration
+keycloak.enabled=false