Skip to content

Commit 43ebc1a

Browse files
GDLMadushankaGDLMadushanka
committed
Add safe XML building and parsing to Script mediator
Use safe methods from Axis2 and Axiom to build and parse XML inputs in the script mediator.
1 parent 7622a30 commit 43ebc1a

7 files changed

Lines changed: 64 additions & 31 deletions

File tree

‎modules/extensions/src/main/java/org/apache/synapse/mediators/bsf/ExtendedJavaScriptXmlHelper.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ public OMElement toOMElement(Object scriptXML) throws ScriptException {
4848
} else if (scriptXML instanceof String) {
4949
try {
5050
String xmlString = scriptXML.toString();
51-
omElement = AXIOMUtil.stringToOM(xmlString);
51+
omElement = AXIOMUtil.stringToOM(xmlString, true);
5252

5353
} catch (XMLStreamException | OMException e) {
5454
ScriptException scriptException = new ScriptException("Failed to create OMElement with provided " +
@@ -59,7 +59,7 @@ public OMElement toOMElement(Object scriptXML) throws ScriptException {
5959
} else if (scriptXML instanceof Document) {
6060
try {
6161
Element element = ((Document) scriptXML).getDocumentElement();
62-
omElement = XMLUtils.toOM(element);
62+
omElement = XMLUtils.toOM(element, true, true);
6363
} catch (Exception e) {
6464
ScriptException scriptException = new ScriptException("Failed to create OMElement with provided " +
6565
"payload");

‎modules/extensions/src/main/java/org/apache/synapse/mediators/bsf/GraalVMJavaScriptMessageContext.java‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -49,12 +49,11 @@
4949
import org.apache.synapse.core.SynapseEnvironment;
5050
import org.apache.synapse.core.axis2.Axis2MessageContext;
5151
import org.apache.synapse.endpoints.Endpoint;
52-
import org.apache.xerces.parsers.DOMParser;
52+
import org.apache.synapse.mediators.bsf.utils.ScriptUtils;
5353
import org.graalvm.polyglot.Context;
5454
import org.graalvm.polyglot.Value;
5555
import org.jaxen.JaxenException;
5656
import org.w3c.dom.Document;
57-
import org.xml.sax.InputSource;
5857
import org.xml.sax.SAXException;
5958

6059
import java.io.ByteArrayInputStream;
@@ -258,13 +257,9 @@ public void setScriptEngine(ScriptEngine scriptEngine) {
258257
* @return parsed document
259258
*/
260259
public Document parseXml(String text) throws ScriptException {
261-
InputSource sax = new InputSource(new java.io.StringReader(text));
262-
DOMParser parser = new DOMParser();
263260
Document doc;
264261
try {
265-
parser.parse(sax);
266-
doc = parser.getDocument();
267-
doc.getDocumentElement().normalize();
262+
doc = ScriptUtils.parseXml(text);
268263
} catch (SAXException | IOException e) {
269264
ScriptException scriptException = new ScriptException("Failed to parse provided xml");
270265
scriptException.initCause(e);
@@ -281,7 +276,7 @@ public Document parseXml(String text) throws ScriptException {
281276
* @return parsed document
282277
*/
283278
public OMElement getParsedOMElement(InputStream stream) {
284-
OMXMLParserWrapper builder = OMXMLBuilderFactory.createOMBuilder(stream);
279+
OMXMLParserWrapper builder = OMXMLBuilderFactory.createOMBuilderWithSec(stream);
285280
return builder.getDocumentElement();
286281
}
287282

‎modules/extensions/src/main/java/org/apache/synapse/mediators/bsf/JavaScriptXmlHelper.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,8 @@ public OMElement toOMElement(Object scriptXML)
7070
OMElement omElement;
7171

7272
try {
73-
omElement = AXIOMUtil.stringToOM((String) ScriptableObject.callMethod(jsXML, "toXMLString", new Object[0]));
73+
omElement = AXIOMUtil.stringToOM((String) ScriptableObject.callMethod(jsXML,
74+
"toXMLString", new Object[0]), true);
7475
} catch (XMLStreamException e) {
7576
throw new ScriptException(e);
7677
}

‎modules/extensions/src/main/java/org/apache/synapse/mediators/bsf/NashornJavaScriptMessageContext.java‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818

1919
package org.apache.synapse.mediators.bsf;
2020

21-
import org.apache.xerces.parsers.DOMParser;
21+
import org.apache.synapse.mediators.bsf.utils.ScriptUtils;
2222
import org.openjdk.nashorn.api.scripting.ScriptObjectMirror;
2323
import org.apache.axiom.om.OMAttribute;
2424
import org.apache.axiom.om.OMElement;
@@ -53,7 +53,6 @@
5353
import org.apache.synapse.endpoints.Endpoint;
5454
import org.jaxen.JaxenException;
5555
import org.w3c.dom.Document;
56-
import org.xml.sax.InputSource;
5756
import org.xml.sax.SAXException;
5857
import java.io.ByteArrayInputStream;
5958
import java.io.IOException;
@@ -235,13 +234,9 @@ public void setScriptEngine(ScriptEngine scriptEngine) {
235234
* @return parsed document
236235
*/
237236
public Document parseXml(String text) throws ScriptException {
238-
InputSource sax = new InputSource(new java.io.StringReader(text));
239-
DOMParser parser = new DOMParser();
240237
Document doc;
241238
try {
242-
parser.parse(sax);
243-
doc = parser.getDocument();
244-
doc.getDocumentElement().normalize();
239+
doc = ScriptUtils.parseXml(text);
245240
} catch (SAXException | IOException e) {
246241
ScriptException scriptException = new ScriptException("Failed to parse provided xml");
247242
scriptException.initCause(e);
@@ -258,7 +253,7 @@ public Document parseXml(String text) throws ScriptException {
258253
* @return parsed document
259254
*/
260255
public OMElement getParsedOMElement(InputStream stream) {
261-
OMXMLParserWrapper builder = OMXMLBuilderFactory.createOMBuilder(stream);
256+
OMXMLParserWrapper builder = OMXMLBuilderFactory.createOMBuilderWithSec(stream);
262257
return builder.getDocumentElement();
263258
}
264259

‎modules/extensions/src/main/java/org/apache/synapse/mediators/bsf/OpenJDKNashornJavaScriptMessageContext.java‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -36,11 +36,10 @@
3636
import org.apache.synapse.core.SynapseEnvironment;
3737
import org.apache.synapse.core.axis2.Axis2MessageContext;
3838
import org.apache.synapse.endpoints.Endpoint;
39-
import org.apache.xerces.parsers.DOMParser;
39+
import org.apache.synapse.mediators.bsf.utils.ScriptUtils;
4040
import org.jaxen.JaxenException;
4141
import org.openjdk.nashorn.api.scripting.ScriptObjectMirror;
4242
import org.w3c.dom.Document;
43-
import org.xml.sax.InputSource;
4443
import org.xml.sax.SAXException;
4544

4645
import javax.script.ScriptEngine;
@@ -241,13 +240,9 @@ public void setScriptEngine(ScriptEngine scriptEngine) {
241240
* @return parsed document
242241
*/
243242
public Document parseXml(String text) throws ScriptException {
244-
InputSource sax = new InputSource(new java.io.StringReader(text));
245-
DOMParser parser = new DOMParser();
246243
Document doc;
247244
try {
248-
parser.parse(sax);
249-
doc = parser.getDocument();
250-
doc.getDocumentElement().normalize();
245+
doc = ScriptUtils.parseXml(text);
251246
} catch (SAXException | IOException e) {
252247
ScriptException scriptException = new ScriptException("Failed to parse provided xml");
253248
scriptException.initCause(e);
@@ -264,7 +259,7 @@ public Document parseXml(String text) throws ScriptException {
264259
* @return parsed document
265260
*/
266261
public OMElement getParsedOMElement(InputStream stream) {
267-
OMXMLParserWrapper builder = OMXMLBuilderFactory.createOMBuilder(stream);
262+
OMXMLParserWrapper builder = OMXMLBuilderFactory.createOMBuilderWithSec(stream);
268263
return builder.getDocumentElement();
269264
}
270265

‎modules/extensions/src/main/java/org/apache/synapse/mediators/bsf/utils/ScriptUtils.java‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
/*
2+
* Copyright (c) 2026, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
3+
*
4+
* WSO2 LLC. licenses this file to you under the Apache License,
5+
* Version 2.0 (the "License"); you may not use this file except
6+
* in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing,
12+
* software distributed under the License is distributed on an
13+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
* KIND, either express or implied. See the License for the
15+
* specific language governing permissions and limitations
16+
* under the License.
17+
*/
18+
package org.apache.synapse.mediators.bsf.utils;
19+
20+
import java.io.IOException;
21+
import org.apache.xerces.parsers.DOMParser;
22+
import org.w3c.dom.Document;
23+
import org.xml.sax.InputSource;
24+
import org.xml.sax.SAXException;
25+
26+
/**
27+
* This class contains secure utility methods to handle XML payloads for the script mediator.
28+
*/
29+
public class ScriptUtils {
30+
31+
public static Document parseXml(String text) throws IOException, SAXException {
32+
InputSource sax = new InputSource(new java.io.StringReader(text));
33+
DOMParser parser = new DOMParser();
34+
// 1. Disable external DTDs completely
35+
parser.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
36+
// 2. Disable external entities (General)
37+
parser.setFeature("http://xml.org/sax/features/external-general-entities", false);
38+
// 3. Disable external entities (Parameter)
39+
parser.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
40+
// 4. Ignore external DTDs if they are present
41+
parser.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
42+
parser.parse(sax);
43+
Document doc = parser.getDocument();
44+
doc.getDocumentElement().normalize();
45+
return doc;
46+
}
47+
}

‎pom.xml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1557,8 +1557,8 @@
15571557
<mina.version>2.1.6</mina.version>
15581558
<jms-1.1-spec.version>1.1</jms-1.1-spec.version>
15591559
<!-- Axis2 and its dependencies -->
1560-
<axis2.version>1.6.1-wso2v124</axis2.version>
1561-
<axis2.transport.version>2.0.0-wso2v86</axis2.transport.version>
1560+
<axis2.version>1.6.1-wso2v123</axis2.version>
1561+
<axis2.transport.version>2.0.0-wso2v85</axis2.transport.version>
15621562
<axiom.version>1.2.11-wso2v36</axiom.version>
15631563
<xml_schema.version>1.4.7</xml_schema.version>
15641564
<xml_apis.version>1.3.04</xml_apis.version>
@@ -1642,8 +1642,8 @@
16421642
<activemq.broker.version>5.9.1</activemq.broker.version>
16431643
<slf4j.log4j.version>1.5.2</slf4j.log4j.version>
16441644
<system.rules.version>1.17.0</system.rules.version>
1645-
<io.netty.version>4.2.12.Final</io.netty.version>
1646-
<transport.http.netty.version>6.4.1</transport.http.netty.version>
1645+
<io.netty.version>4.2.9.Final</io.netty.version>
1646+
<transport.http.netty.version>6.3.60</transport.http.netty.version>
16471647
<version.org.wso2.orbit.javax.activation>1.1.1.wso2v3</version.org.wso2.orbit.javax.activation>
16481648
<rabbitmq.version>5.20.0</rabbitmq.version>
16491649
<opentelemetry.all.version>1.57.0.wso2v3</opentelemetry.all.version>

0 commit comments

Comments
 (0)