diff --git a/modules/core/src/main/java/org/apache/synapse/config/SynapseConfigUtils.java b/modules/core/src/main/java/org/apache/synapse/config/SynapseConfigUtils.java index f544cc44d..a41297d3d 100644 --- a/modules/core/src/main/java/org/apache/synapse/config/SynapseConfigUtils.java +++ b/modules/core/src/main/java/org/apache/synapse/config/SynapseConfigUtils.java @@ -791,6 +791,36 @@ public static OMElement stringToOM(String xml) { return null; } + /** + * Builds an {@link OMElement} from a string whose content comes from the message (an XPath + * result, a property value, an XQuery variable, ...), parsing it the same way the inbound + * message itself is parsed rather than with {@link #stringToOM(String)}'s default settings. + * A document type declaration in the string is rejected. + * + * @param xml the message-derived string to parse + * @return the parsed {@link OMElement}, or {@code null} if the input is {@code null} + */ + public static OMElement stringToOMDisallowingDTD(String xml) { + if (xml == null) { + return null; + } + try { + XMLInputFactory inputFactory = XMLInputFactory.newInstance(); + inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE); + inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE); + XMLStreamReader reader = inputFactory.createXMLStreamReader(new StringReader(xml)); + OMElement element = OMXMLBuilderFactory.createStAXOMBuilder(reader).getDocumentElement(); + if (element != null) { + element.build(); + } + return element; + } catch (XMLStreamException | OMException e) { + handleException("Unable to convert a string to OM Node as the string " + + "is malformed , String : " + xml, e); + } + return null; + } + /** * Construct a fresh SynapseConfiguration instance and registers the observers * with it as specified in the synapse.properties file. Use the initial.observers diff --git a/modules/core/src/main/java/org/apache/synapse/mediators/builtin/PropertyMediator.java b/modules/core/src/main/java/org/apache/synapse/mediators/builtin/PropertyMediator.java index 32e262b10..b68c275f6 100644 --- a/modules/core/src/main/java/org/apache/synapse/mediators/builtin/PropertyMediator.java +++ b/modules/core/src/main/java/org/apache/synapse/mediators/builtin/PropertyMediator.java @@ -311,7 +311,7 @@ private Object convertValue(String value, String type) { case FLOAT : return Float.parseFloat(value); case INTEGER : return Integer.parseInt(value); case LONG : return Long.parseLong(value); - case OM : return SynapseConfigUtils.stringToOM(value); + case OM : return SynapseConfigUtils.stringToOMDisallowingDTD(value); case SHORT : return Short.parseShort(value); default : return value; } diff --git a/modules/core/src/main/java/org/apache/synapse/mediators/elementary/Target.java b/modules/core/src/main/java/org/apache/synapse/mediators/elementary/Target.java index fa2bec76f..b867a0d40 100644 --- a/modules/core/src/main/java/org/apache/synapse/mediators/elementary/Target.java +++ b/modules/core/src/main/java/org/apache/synapse/mediators/elementary/Target.java @@ -22,17 +22,16 @@ import org.apache.axiom.om.OMElement; import org.apache.axiom.om.OMNode; import org.apache.axiom.om.OMText; -import org.apache.axiom.om.util.AXIOMUtil; import org.apache.axiom.soap.SOAPBody; import org.apache.axiom.soap.SOAPEnvelope; import org.apache.axis2.AxisFault; import org.apache.synapse.MessageContext; import org.apache.synapse.SynapseException; import org.apache.synapse.SynapseLog; +import org.apache.synapse.config.SynapseConfigUtils; import org.apache.synapse.util.xpath.SynapseXPath; import org.jaxen.JaxenException; -import javax.xml.stream.XMLStreamException; import java.util.ArrayList; /** @@ -150,12 +149,8 @@ public void insert(MessageContext synContext, if (propertyObj instanceof OMElement) { documentElement = (OMElement) propertyObj; } else { - try { - documentElement = AXIOMUtil.stringToOM(propertyObj.toString()); - } catch (XMLStreamException e) { - throw new SynapseException("Error while converting property value into" + - " an OMElement"); - } + documentElement = + SynapseConfigUtils.stringToOMDisallowingDTD(propertyObj.toString()); } insertElement(sourceNodeList, documentElement, synLog); synContext.setProperty(property, documentElement); diff --git a/modules/core/src/main/java/org/apache/synapse/util/xpath/SourceXPathSupport.java b/modules/core/src/main/java/org/apache/synapse/util/xpath/SourceXPathSupport.java index 1d3ddebe0..6c1d02fff 100644 --- a/modules/core/src/main/java/org/apache/synapse/util/xpath/SourceXPathSupport.java +++ b/modules/core/src/main/java/org/apache/synapse/util/xpath/SourceXPathSupport.java @@ -95,7 +95,7 @@ public OMNode selectOMNode(MessageContext synCtx, SynapseLog synLog) { if (result instanceof OMNode) { return (OMNode) result; } else if (result instanceof String) { - return SynapseConfigUtils.stringToOM((String) result); + return SynapseConfigUtils.stringToOMDisallowingDTD((String) result); } else { throw new SynapseException("The evaluation of the XPath expression " + xpath + " did not result in an OMNode : " + result, synLog); diff --git a/modules/extensions/src/main/java/org/apache/synapse/mediators/xquery/XQueryMediator.java b/modules/extensions/src/main/java/org/apache/synapse/mediators/xquery/XQueryMediator.java index 878812e72..19c66ac46 100644 --- a/modules/extensions/src/main/java/org/apache/synapse/mediators/xquery/XQueryMediator.java +++ b/modules/extensions/src/main/java/org/apache/synapse/mediators/xquery/XQueryMediator.java @@ -621,7 +621,7 @@ private void bindOMNode(QName name, Object value, OMElement variableValue = null; if (value instanceof String) { - variableValue = SynapseConfigUtils.stringToOM((String) value); + variableValue = SynapseConfigUtils.stringToOMDisallowingDTD((String) value); } else if (value instanceof OMElement) { variableValue = (OMElement) value; } diff --git a/modules/extensions/src/test/java/org/apache/synapse/mediators/xquery/XQueryMediatorTest.java b/modules/extensions/src/test/java/org/apache/synapse/mediators/xquery/XQueryMediatorTest.java index 93e5e6f97..ac079cec9 100644 --- a/modules/extensions/src/test/java/org/apache/synapse/mediators/xquery/XQueryMediatorTest.java +++ b/modules/extensions/src/test/java/org/apache/synapse/mediators/xquery/XQueryMediatorTest.java @@ -21,6 +21,7 @@ import junit.framework.TestCase; import org.apache.axiom.om.OMAbstractFactory; import org.apache.synapse.MessageContext; +import org.apache.synapse.SynapseException; import org.apache.synapse.config.SynapseConfigUtils; import org.apache.synapse.mediators.TestUtils; @@ -269,4 +270,23 @@ public void testEmptyBodyQuery() throws Exception { assertTrue(mediator.mediate(mc)); assertEquals("testing", mc.getEnvelope().getBody().getFirstElement().getLocalName()); } + + public void testElementVariableRejectsDoctype() throws Exception { + MessageContext mc = TestUtils.getTestContext(sampleXml, null); + XQueryMediator mediator = new XQueryMediator(); + List list = new ArrayList(); + MediatorVariable variable = new MediatorBaseVariable(new QName("payload")); + variable.setType(XQItemType.XQITEMKIND_ELEMENT); + variable.setValue(" ]>text"); + list.add(variable); + mediator.addAllVariables(list); + mediator.setQuerySource( + "declare variable $payload as element() external; $payload"); + try { + mediator.mediate(mc); + fail("A message-derived value carrying a document type declaration must be rejected"); + } catch (SynapseException expected) { + // expected: the declaration-bearing variable value is rejected as malformed + } + } }