Repository: activemq Updated Branches: refs/heads/master 8cc0c5ad6 -> 112c4e602
Enable secure processing on all DocumentBuilderFactory.newInstance() Project: http://git-wip-us.apache.org/repos/asf/activemq/repo Commit: http://git-wip-us.apache.org/repos/asf/activemq/commit/a87b61e8 Tree: http://git-wip-us.apache.org/repos/asf/activemq/tree/a87b61e8 Diff: http://git-wip-us.apache.org/repos/asf/activemq/diff/a87b61e8 Branch: refs/heads/master Commit: a87b61e8be13f190c0f5db422e75a08f347c4052 Parents: 8cc0c5a Author: Colm O hEigeartaigh <[email protected]> Authored: Thu Nov 22 10:24:43 2018 +0000 Committer: Colm O hEigeartaigh <[email protected]> Committed: Thu Nov 22 10:24:43 2018 +0000 ---------------------------------------------------------------------- .../main/java/org/apache/activemq/filter/XPathExpression.java | 2 ++ .../org/apache/activemq/console/command/CreateCommand.java | 6 +++++- .../org/apache/activemq/plugin/RuntimeConfigurationBroker.java | 5 ++++- 3 files changed, 11 insertions(+), 2 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/activemq/blob/a87b61e8/activemq-client/src/main/java/org/apache/activemq/filter/XPathExpression.java ---------------------------------------------------------------------- diff --git a/activemq-client/src/main/java/org/apache/activemq/filter/XPathExpression.java b/activemq-client/src/main/java/org/apache/activemq/filter/XPathExpression.java index 75ab087..e90e15f 100644 --- a/activemq-client/src/main/java/org/apache/activemq/filter/XPathExpression.java +++ b/activemq-client/src/main/java/org/apache/activemq/filter/XPathExpression.java @@ -25,6 +25,7 @@ import java.util.Map; import java.util.Properties; import javax.jms.JMSException; +import javax.xml.XMLConstants; import javax.xml.parsers.DocumentBuilder; import javax.xml.parsers.DocumentBuilderFactory; import javax.xml.parsers.ParserConfigurationException; @@ -59,6 +60,7 @@ public final class XPathExpression implements BooleanExpression { builderFactory.setIgnoringComments(true); try { // set some reasonable defaults + builderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE); builderFactory.setFeature("http://xml.org/sax/features/external-general-entities";, false); builderFactory.setFeature("http://xml.org/sax/features/external-parameter-entities";, false); builderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl";, true); http://git-wip-us.apache.org/repos/asf/activemq/blob/a87b61e8/activemq-console/src/main/java/org/apache/activemq/console/command/CreateCommand.java ---------------------------------------------------------------------- diff --git a/activemq-console/src/main/java/org/apache/activemq/console/command/CreateCommand.java b/activemq-console/src/main/java/org/apache/activemq/console/command/CreateCommand.java index 28080e6..f9f0fb0 100644 --- a/activemq-console/src/main/java/org/apache/activemq/console/command/CreateCommand.java +++ b/activemq-console/src/main/java/org/apache/activemq/console/command/CreateCommand.java @@ -20,6 +20,7 @@ import org.w3c.dom.Attr; import org.w3c.dom.Element; import org.xml.sax.SAXException; +import javax.xml.XMLConstants; import javax.xml.parsers.DocumentBuilder; import javax.xml.parsers.DocumentBuilderFactory; import javax.xml.parsers.ParserConfigurationException; @@ -158,7 +159,10 @@ public class CreateCommand extends AbstractCommand { File dest = new File(targetBase, DEFAULT_TARGET_ACTIVEMQ_CONF); context.print("Copying from: " + src.getCanonicalPath() + "\n to: " + dest.getCanonicalPath()); - DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder(); + DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); + dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE); + dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl";, true); + DocumentBuilder builder = dbf.newDocumentBuilder(); Element docElem = builder.parse(src).getDocumentElement(); XPath xpath = XPathFactory.newInstance().newXPath(); http://git-wip-us.apache.org/repos/asf/activemq/blob/a87b61e8/activemq-runtime-config/src/main/java/org/apache/activemq/plugin/RuntimeConfigurationBroker.java ---------------------------------------------------------------------- diff --git a/activemq-runtime-config/src/main/java/org/apache/activemq/plugin/RuntimeConfigurationBroker.java b/activemq-runtime-config/src/main/java/org/apache/activemq/plugin/RuntimeConfigurationBroker.java index 7a06c87..0d7e17f 100644 --- a/activemq-runtime-config/src/main/java/org/apache/activemq/plugin/RuntimeConfigurationBroker.java +++ b/activemq-runtime-config/src/main/java/org/apache/activemq/plugin/RuntimeConfigurationBroker.java @@ -180,6 +180,9 @@ public class RuntimeConfigurationBroker extends AbstractRuntimeConfigurationBrok // skip beans and pull out the broker node to validate DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); dbf.setNamespaceAware(true); + dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE); + dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl";, true); + DocumentBuilder db = dbf.newDocumentBuilder(); Document doc = db.parse(configToMonitor.getInputStream()); Node brokerRootNode = doc.getElementsByTagNameNS("*","broker").item(0); @@ -252,4 +255,4 @@ public class RuntimeConfigurationBroker extends AbstractRuntimeConfigurationBrok this.checkPeriod = checkPeriod; } -} \ No newline at end of file +}
