This is an automated email from the ASF dual-hosted git repository.
Claudenw pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/creadur-rat.git
The following commit(s) were added to refs/heads/master by this push:
new 8f1322a3 RAT-560, RAT-558: Fix XXE warning (#694)
8f1322a3 is described below
commit 8f1322a3dd2444e442ce0f2108255c951b885ed5
Author: P. Ottlinger <[email protected]>
AuthorDate: Sat Jul 4 17:52:41 2026 +0200
RAT-560, RAT-558: Fix XXE warning (#694)
* RAT-560, RAT-558: Fix XXE warning while processing provided stylesheets
via StandardXmlFactory
---
apache-rat-core/src/main/java/org/apache/rat/Reporter.java | 14 +-------------
.../java/org/apache/rat/report/xml/writer/XmlWriter.java | 2 +-
.../main/java/org/apache/rat/utils/StandardXmlFactory.java | 8 ++++----
.../java/org/apache/rat/utils/StandardXmlFactoryTests.java | 4 ++--
.../main/java/org/apache/rat/tools/xsd/XsdGenerator.java | 4 +---
5 files changed, 9 insertions(+), 23 deletions(-)
diff --git a/apache-rat-core/src/main/java/org/apache/rat/Reporter.java
b/apache-rat-core/src/main/java/org/apache/rat/Reporter.java
index 6ca704ca..5cf396d9 100644
--- a/apache-rat-core/src/main/java/org/apache/rat/Reporter.java
+++ b/apache-rat-core/src/main/java/org/apache/rat/Reporter.java
@@ -28,13 +28,9 @@ import java.io.PrintWriter;
import java.io.Writer;
import java.nio.charset.StandardCharsets;
-import javax.xml.transform.OutputKeys;
-import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactory;
import javax.xml.transform.dom.DOMSource;
import javax.xml.transform.stream.StreamResult;
-import javax.xml.transform.stream.StreamSource;
import org.apache.commons.io.function.IOSupplier;
import org.apache.rat.api.RatException;
@@ -136,17 +132,9 @@ public class Reporter {
*/
public ClaimStatistic output(final IOSupplier<InputStream> stylesheet,
final IOSupplier<OutputStream> output) throws RatException {
ClaimStatistic result = execute();
- TransformerFactory tf = TransformerFactory.newInstance();
- Transformer transformer;
try (OutputStream out = output.get();
InputStream styleIn = stylesheet.get()) {
- transformer = tf.newTransformer(new StreamSource(styleIn));
- transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION,
"yes");
- transformer.setOutputProperty(OutputKeys.METHOD, "xml");
- transformer.setOutputProperty(OutputKeys.INDENT, "yes");
- transformer.setOutputProperty(OutputKeys.ENCODING, "UTF-8");
-
transformer.setOutputProperty("{http://xml.apache.org/xslt}indent-amount";, "4");
- transformer.transform(new DOMSource(document),
+ StandardXmlFactory.createTransformer(styleIn).transform(new
DOMSource(document),
new StreamResult(new OutputStreamWriter(out,
StandardCharsets.UTF_8)));
return result;
} catch (TransformerException | IOException e) {
diff --git
a/apache-rat-core/src/main/java/org/apache/rat/report/xml/writer/XmlWriter.java
b/apache-rat-core/src/main/java/org/apache/rat/report/xml/writer/XmlWriter.java
index c9c0c16d..40440845 100644
---
a/apache-rat-core/src/main/java/org/apache/rat/report/xml/writer/XmlWriter.java
+++
b/apache-rat-core/src/main/java/org/apache/rat/report/xml/writer/XmlWriter.java
@@ -356,7 +356,7 @@ public final class XmlWriter implements AutoCloseable {
appendable.append(System.lineSeparator());
currentAttributes.clear();
try {
- Transformer transformer = StandardXmlFactory.create();
+ Transformer transformer = StandardXmlFactory.createTransformer();
ByteArrayOutputStream baos = new ByteArrayOutputStream();
transformer.transform(new DOMSource(document),
new StreamResult(baos));
diff --git
a/apache-rat-core/src/main/java/org/apache/rat/utils/StandardXmlFactory.java
b/apache-rat-core/src/main/java/org/apache/rat/utils/StandardXmlFactory.java
index 38f4cd08..3ec9849a 100644
--- a/apache-rat-core/src/main/java/org/apache/rat/utils/StandardXmlFactory.java
+++ b/apache-rat-core/src/main/java/org/apache/rat/utils/StandardXmlFactory.java
@@ -52,8 +52,8 @@ public final class StandardXmlFactory {
* @return the transformer.
* @throws TransformerConfigurationException on error.
*/
- public static Transformer create() throws
TransformerConfigurationException {
- return create(null);
+ public static Transformer createTransformer() throws
TransformerConfigurationException {
+ return createTransformer(null);
}
/**
@@ -62,8 +62,8 @@ public final class StandardXmlFactory {
* @return the transformer.
* @throws TransformerConfigurationException on error.
*/
- public static Transformer create(final InputStream styleIn) throws
TransformerConfigurationException {
- TransformerFactory factory = TransformerFactory.newInstance();
+ public static Transformer createTransformer(final InputStream styleIn)
throws TransformerConfigurationException {
+ TransformerFactory factory = TransformerFactory.newInstance(); //
NOSONAR
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
diff --git
a/apache-rat-core/src/test/java/org/apache/rat/utils/StandardXmlFactoryTests.java
b/apache-rat-core/src/test/java/org/apache/rat/utils/StandardXmlFactoryTests.java
index e33c10d8..bfffac4f 100644
---
a/apache-rat-core/src/test/java/org/apache/rat/utils/StandardXmlFactoryTests.java
+++
b/apache-rat-core/src/test/java/org/apache/rat/utils/StandardXmlFactoryTests.java
@@ -37,12 +37,12 @@ class StandardXmlFactoryTests {
@Test
void noArg() throws TransformerConfigurationException {
- assertThat(StandardXmlFactory.create()).isNotNull();
+ assertThat(StandardXmlFactory.createTransformer()).isNotNull();
}
@Test
void noEmptyInput() {
- assertThatThrownBy(() ->
StandardXmlFactory.create(InputStream.nullInputStream()))
+ assertThatThrownBy(() ->
StandardXmlFactory.createTransformer(InputStream.nullInputStream()))
.isInstanceOf(TransformerConfigurationException.class);
}
diff --git
a/apache-rat-tools/src/main/java/org/apache/rat/tools/xsd/XsdGenerator.java
b/apache-rat-tools/src/main/java/org/apache/rat/tools/xsd/XsdGenerator.java
index a3ceb01c..b3860c12 100644
--- a/apache-rat-tools/src/main/java/org/apache/rat/tools/xsd/XsdGenerator.java
+++ b/apache-rat-tools/src/main/java/org/apache/rat/tools/xsd/XsdGenerator.java
@@ -30,7 +30,6 @@ import java.util.HashMap;
import java.util.List;
import java.util.Map;
-import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerException;
import javax.xml.transform.stream.StreamResult;
import javax.xml.transform.stream.StreamSource;
@@ -72,8 +71,7 @@ public class XsdGenerator {
try (InputStream in = generator.getInputStream();
InputStream styleIn = StyleSheets.XML.getStyleSheet().get()) {
- Transformer transformer = StandardXmlFactory.create(styleIn);
- transformer.transform(new StreamSource(in),
+ StandardXmlFactory.createTransformer(styleIn).transform(new
StreamSource(in),
new StreamResult(new OutputStreamWriter(System.out,
StandardCharsets.UTF_8)));
}
}
