Reject document type declarations when parsing XML from message content

modules/core/src/main/java/org/apache/synapse/config/SynapseConfigUtils.java

@@ -791,6 +791,36 @@ public static OMElement stringToOM(String xml) {
         return null;
     }
 
+    /**
+     * Builds an {@link OMElement} from a string whose content comes from the message (an XPath
+     * result, a property value, an XQuery variable, ...), parsing it the same way the inbound
+     * message itself is parsed rather than with {@link #stringToOM(String)}'s default settings.
+     * A document type declaration in the string is rejected.
+     *
+     * @param xml the message-derived string to parse
+     * @return the parsed {@link OMElement}, or {@code null} if the input is {@code null}
+     */
+    public static OMElement stringToOMDisallowingDTD(String xml) {
+        if (xml == null) {
+            return null;
+        }
+        try {
+            XMLInputFactory inputFactory = XMLInputFactory.newInstance();
+            inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE);
+            inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);
+            XMLStreamReader reader = inputFactory.createXMLStreamReader(new StringReader(xml));
+            OMElement element = OMXMLBuilderFactory.createStAXOMBuilder(reader).getDocumentElement();
+            if (element != null) {
+                element.build();
+            }
+            return element;
+        } catch (XMLStreamException | OMException e) {
+            handleException("Unable to convert a string to OM Node as the string " +
+                    "is malformed , String : " + xml, e);
+        }
+        return null;
+    }
+
     /**
      * Construct a fresh SynapseConfiguration instance and registers the observers
      * with it as specified in the synapse.properties file. Use the initial.observers

modules/core/src/main/java/org/apache/synapse/mediators/builtin/PropertyMediator.java

@@ -311,7 +311,7 @@ private Object convertValue(String value, String type) {
                 case FLOAT      : return Float.parseFloat(value);
                 case INTEGER    : return Integer.parseInt(value);
                 case LONG       : return Long.parseLong(value);
-                case OM         : return SynapseConfigUtils.stringToOM(value);
+                case OM         : return SynapseConfigUtils.stringToOMDisallowingDTD(value);
                 case SHORT      : return Short.parseShort(value);
                 default         : return value;
             }

modules/core/src/main/java/org/apache/synapse/mediators/elementary/Target.java

@@ -22,17 +22,16 @@
 import org.apache.axiom.om.OMElement;
 import org.apache.axiom.om.OMNode;
 import org.apache.axiom.om.OMText;
-import org.apache.axiom.om.util.AXIOMUtil;
 import org.apache.axiom.soap.SOAPBody;
 import org.apache.axiom.soap.SOAPEnvelope;
 import org.apache.axis2.AxisFault;
 import org.apache.synapse.MessageContext;
 import org.apache.synapse.SynapseException;
 import org.apache.synapse.SynapseLog;
+import org.apache.synapse.config.SynapseConfigUtils;
 import org.apache.synapse.util.xpath.SynapseXPath;
 import org.jaxen.JaxenException;
 
-import javax.xml.stream.XMLStreamException;
 import java.util.ArrayList;
 
 /**
@@ -150,12 +149,8 @@ public void insert(MessageContext synContext,
                 if (propertyObj instanceof OMElement) {
                     documentElement = (OMElement) propertyObj;
                 } else {
-                    try {
-                        documentElement = AXIOMUtil.stringToOM(propertyObj.toString());
-                    } catch (XMLStreamException e) {
-                        throw new SynapseException("Error while converting property value into" +
-                                " an OMElement");
-                    }
+                    documentElement =
+                            SynapseConfigUtils.stringToOMDisallowingDTD(propertyObj.toString());
                 }
                 insertElement(sourceNodeList, documentElement, synLog);
                 synContext.setProperty(property, documentElement);

modules/core/src/main/java/org/apache/synapse/util/xpath/SourceXPathSupport.java

@@ -95,7 +95,7 @@ public OMNode selectOMNode(MessageContext synCtx, SynapseLog synLog) {
             if (result instanceof OMNode) {
                 return (OMNode) result;
             } else if (result instanceof String) {
-                return SynapseConfigUtils.stringToOM((String) result);
+                return SynapseConfigUtils.stringToOMDisallowingDTD((String) result);
             } else {
                 throw new SynapseException("The evaluation of the XPath expression "
                         + xpath + " did not result in an OMNode : " + result, synLog);

modules/extensions/src/main/java/org/apache/synapse/mediators/xquery/XQueryMediator.java

@@ -621,7 +621,7 @@ private void bindOMNode(QName name, Object value,
 
         OMElement variableValue = null;
         if (value instanceof String) {
-            variableValue = SynapseConfigUtils.stringToOM((String) value);
+            variableValue = SynapseConfigUtils.stringToOMDisallowingDTD((String) value);
         } else if (value instanceof OMElement) {
             variableValue = (OMElement) value;
         }

modules/extensions/src/test/java/org/apache/synapse/mediators/xquery/XQueryMediatorTest.java

@@ -21,6 +21,7 @@
 import junit.framework.TestCase;
 import org.apache.axiom.om.OMAbstractFactory;
 import org.apache.synapse.MessageContext;
+import org.apache.synapse.SynapseException;
 import org.apache.synapse.config.SynapseConfigUtils;
 import org.apache.synapse.mediators.TestUtils;
 
@@ -269,4 +270,23 @@ public void testEmptyBodyQuery() throws Exception {
         assertTrue(mediator.mediate(mc));
         assertEquals("testing", mc.getEnvelope().getBody().getFirstElement().getLocalName());
     }
+
+    public void testElementVariableRejectsDoctype() throws Exception {
+        MessageContext mc = TestUtils.getTestContext(sampleXml, null);
+        XQueryMediator mediator = new XQueryMediator();
+        List<MediatorVariable> list = new ArrayList<MediatorVariable>();
+        MediatorVariable variable = new MediatorBaseVariable(new QName("payload"));
+        variable.setType(XQItemType.XQITEMKIND_ELEMENT);
+        variable.setValue("<!DOCTYPE root [ <!ENTITY greeting \"hello\"> ]><root>text</root>");
+        list.add(variable);
+        mediator.addAllVariables(list);
+        mediator.setQuerySource(
+                "declare variable $payload as element() external; $payload");
+        try {
+            mediator.mediate(mc);
+            fail("A message-derived value carrying a document type declaration must be rejected");
+        } catch (SynapseException expected) {
+            // expected: the declaration-bearing variable value is rejected as malformed
+        }
+    }
 }