This is an automated email from the ASF dual-hosted git repository. ottlinger pushed a commit to branch fix/XXEwarningInReporter in repository https://gitbox.apache.org/repos/asf/creadur-rat.git
commit d3a0d69dc5d4af95f6490af6c2ad1bdaf879c59d Author: P. Ottlinger <[email protected]> AuthorDate: Thu Jul 2 12:47:16 2026 +0200 RAT-560, RAT-558: Fix XXE warning while processing provided stylesheets via StandardXmlFactory --- apache-rat-core/src/main/java/org/apache/rat/Reporter.java | 12 +----------- .../java/org/apache/rat/report/xml/writer/XmlWriter.java | 2 +- .../main/java/org/apache/rat/utils/StandardXmlFactory.java | 8 ++++---- .../java/org/apache/rat/utils/StandardXmlFactoryTests.java | 4 ++-- .../src/main/java/org/apache/rat/tools/xsd/XsdGenerator.java | 2 +- 5 files changed, 9 insertions(+), 19 deletions(-) diff --git a/apache-rat-core/src/main/java/org/apache/rat/Reporter.java b/apache-rat-core/src/main/java/org/apache/rat/Reporter.java index 6ca704ca..aa24ad47 100644 --- a/apache-rat-core/src/main/java/org/apache/rat/Reporter.java +++ b/apache-rat-core/src/main/java/org/apache/rat/Reporter.java @@ -28,13 +28,10 @@ import java.io.PrintWriter; import java.io.Writer; import java.nio.charset.StandardCharsets; -import javax.xml.transform.OutputKeys; import javax.xml.transform.Transformer; import javax.xml.transform.TransformerException; -import javax.xml.transform.TransformerFactory; import javax.xml.transform.dom.DOMSource; import javax.xml.transform.stream.StreamResult; -import javax.xml.transform.stream.StreamSource; import org.apache.commons.io.function.IOSupplier; import org.apache.rat.api.RatException; @@ -136,16 +133,9 @@ public class Reporter { */ public ClaimStatistic output(final IOSupplier<InputStream> stylesheet, final IOSupplier<OutputStream> output) throws RatException { ClaimStatistic result = execute(); - TransformerFactory tf = TransformerFactory.newInstance(); - Transformer transformer; try (OutputStream out = output.get(); InputStream styleIn = stylesheet.get()) { - transformer = tf.newTransformer(new StreamSource(styleIn)); - transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes"); - transformer.setOutputProperty(OutputKeys.METHOD, "xml"); - transformer.setOutputProperty(OutputKeys.INDENT, "yes"); - transformer.setOutputProperty(OutputKeys.ENCODING, "UTF-8"); - transformer.setOutputProperty("{http://xml.apache.org/xslt}indent-amount";, "4"); + Transformer transformer = StandardXmlFactory.createTransformer(styleIn); transformer.transform(new DOMSource(document), new StreamResult(new OutputStreamWriter(out, StandardCharsets.UTF_8))); return result; diff --git a/apache-rat-core/src/main/java/org/apache/rat/report/xml/writer/XmlWriter.java b/apache-rat-core/src/main/java/org/apache/rat/report/xml/writer/XmlWriter.java index c9c0c16d..40440845 100644 --- a/apache-rat-core/src/main/java/org/apache/rat/report/xml/writer/XmlWriter.java +++ b/apache-rat-core/src/main/java/org/apache/rat/report/xml/writer/XmlWriter.java @@ -356,7 +356,7 @@ public final class XmlWriter implements AutoCloseable { appendable.append(System.lineSeparator()); currentAttributes.clear(); try { - Transformer transformer = StandardXmlFactory.create(); + Transformer transformer = StandardXmlFactory.createTransformer(); ByteArrayOutputStream baos = new ByteArrayOutputStream(); transformer.transform(new DOMSource(document), new StreamResult(baos)); diff --git a/apache-rat-core/src/main/java/org/apache/rat/utils/StandardXmlFactory.java b/apache-rat-core/src/main/java/org/apache/rat/utils/StandardXmlFactory.java index 38f4cd08..3ec9849a 100644 --- a/apache-rat-core/src/main/java/org/apache/rat/utils/StandardXmlFactory.java +++ b/apache-rat-core/src/main/java/org/apache/rat/utils/StandardXmlFactory.java @@ -52,8 +52,8 @@ public final class StandardXmlFactory { * @return the transformer. * @throws TransformerConfigurationException on error. */ - public static Transformer create() throws TransformerConfigurationException { - return create(null); + public static Transformer createTransformer() throws TransformerConfigurationException { + return createTransformer(null); } /** @@ -62,8 +62,8 @@ public final class StandardXmlFactory { * @return the transformer. * @throws TransformerConfigurationException on error. */ - public static Transformer create(final InputStream styleIn) throws TransformerConfigurationException { - TransformerFactory factory = TransformerFactory.newInstance(); + public static Transformer createTransformer(final InputStream styleIn) throws TransformerConfigurationException { + TransformerFactory factory = TransformerFactory.newInstance(); // NOSONAR factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); diff --git a/apache-rat-core/src/test/java/org/apache/rat/utils/StandardXmlFactoryTests.java b/apache-rat-core/src/test/java/org/apache/rat/utils/StandardXmlFactoryTests.java index e33c10d8..bfffac4f 100644 --- a/apache-rat-core/src/test/java/org/apache/rat/utils/StandardXmlFactoryTests.java +++ b/apache-rat-core/src/test/java/org/apache/rat/utils/StandardXmlFactoryTests.java @@ -37,12 +37,12 @@ class StandardXmlFactoryTests { @Test void noArg() throws TransformerConfigurationException { - assertThat(StandardXmlFactory.create()).isNotNull(); + assertThat(StandardXmlFactory.createTransformer()).isNotNull(); } @Test void noEmptyInput() { - assertThatThrownBy(() -> StandardXmlFactory.create(InputStream.nullInputStream())) + assertThatThrownBy(() -> StandardXmlFactory.createTransformer(InputStream.nullInputStream())) .isInstanceOf(TransformerConfigurationException.class); } diff --git a/apache-rat-tools/src/main/java/org/apache/rat/tools/xsd/XsdGenerator.java b/apache-rat-tools/src/main/java/org/apache/rat/tools/xsd/XsdGenerator.java index a3ceb01c..7f126190 100644 --- a/apache-rat-tools/src/main/java/org/apache/rat/tools/xsd/XsdGenerator.java +++ b/apache-rat-tools/src/main/java/org/apache/rat/tools/xsd/XsdGenerator.java @@ -72,7 +72,7 @@ public class XsdGenerator { try (InputStream in = generator.getInputStream(); InputStream styleIn = StyleSheets.XML.getStyleSheet().get()) { - Transformer transformer = StandardXmlFactory.create(styleIn); + Transformer transformer = StandardXmlFactory.createTransformer(styleIn); transformer.transform(new StreamSource(in), new StreamResult(new OutputStreamWriter(System.out, StandardCharsets.UTF_8))); }
