This is an automated email from the ASF dual-hosted git repository.
reta pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/main by this push:
new 7cfa2fb7ba0 More SchemaFactory hardenings (#3157)
7cfa2fb7ba0 is described below
commit 7cfa2fb7ba0bdfe16f149257769ea5e7c6953bf9
Author: Andriy Redko <[email protected]>
AuthorDate: Tue Jun 2 11:35:26 2026 -0400
More SchemaFactory hardenings (#3157)
* More SchemaFactory hardenings
* Address code review comments
---
.../validation/W3CMultiSchemaFactory.java | 22 +++++++++++++++++++++-
.../cxf/ws/addressing/EndpointReferenceUtils.java | 21 +++++++++++++++++++++
.../org/apache/cxf/aegis/type/XMLTypeCreator.java | 1 +
.../main/java/org/apache/cxf/ws/rm/RMEndpoint.java | 1 +
.../tools/common/dom/ExtendedDocumentBuilder.java | 21 +++++++++++++++++++++
.../wsdlto/databinding/jaxb/JAXBDataBinding.java | 8 ++++++++
6 files changed, 73 insertions(+), 1 deletion(-)
diff --git
a/core/src/main/java/org/apache/cxf/staxutils/validation/W3CMultiSchemaFactory.java
b/core/src/main/java/org/apache/cxf/staxutils/validation/W3CMultiSchemaFactory.java
index 27cd4513603..e5a24d8c47e 100644
---
a/core/src/main/java/org/apache/cxf/staxutils/validation/W3CMultiSchemaFactory.java
+++
b/core/src/main/java/org/apache/cxf/staxutils/validation/W3CMultiSchemaFactory.java
@@ -29,7 +29,11 @@ import java.util.HashMap;
import java.util.Map;
import java.util.Set;
import java.util.TreeSet;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import javax.xml.XMLConstants;
+import javax.xml.parsers.ParserConfigurationException;
import javax.xml.parsers.SAXParserFactory;
import javax.xml.stream.XMLStreamException;
import javax.xml.transform.Source;
@@ -40,6 +44,8 @@ import org.w3c.dom.Element;
import org.w3c.dom.Node;
import org.xml.sax.Locator;
+import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
import com.ctc.wstx.msv.W3CSchema;
import com.sun.msv.grammar.ExpressionPool;
@@ -53,14 +59,17 @@ import com.sun.msv.reader.xmlschema.SchemaState;
import com.sun.msv.reader.xmlschema.WSDLGrammarReaderController;
import com.sun.msv.reader.xmlschema.XMLSchemaReader;
+import org.apache.cxf.common.logging.LogUtils;
import org.codehaus.stax2.validation.XMLValidationSchema;
/**
* Legacy implementation for Woostox 5.x. For Woodstox 6.2+, use
W3CMultiSchemaFactory in
* Woodstox itself.
*/
+@Deprecated(forRemoval = true, since = "4.2.1")
public class W3CMultiSchemaFactory {
-
+ private static final Logger LOG =
LogUtils.getL7dLogger(W3CMultiSchemaFactory.class);
+
private MultiSchemaReader multiSchemaReader;
private SAXParserFactory parserFactory;
private RecursiveAllowedXMLSchemaReader xmlSchemaReader;
@@ -139,6 +148,17 @@ public class W3CMultiSchemaFactory {
}
}
parserFactory = SAXParserFactory.newInstance();
+ try {
+ parserFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING,
Boolean.TRUE);
+ } catch (SAXNotRecognizedException | SAXNotSupportedException |
ParserConfigurationException e) {
+ LOG.log(Level.WARNING, "The property '" +
XMLConstants.FEATURE_SECURE_PROCESSING + "', is not supported.");
+ }
+ try {
+
parserFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl";,
true);
+ } catch (SAXNotRecognizedException | SAXNotSupportedException |
ParserConfigurationException e) {
+ LOG.log(Level.WARNING, "The property
'http://apache.org/xml/features/disallow-doctype-decl'"
+ + " is not supported.");
+ }
parserFactory.setNamespaceAware(true);
WSDLGrammarReaderController ctrl = new
WSDLGrammarReaderController(null, baseURI, embeddedSources);
diff --git
a/core/src/main/java/org/apache/cxf/ws/addressing/EndpointReferenceUtils.java
b/core/src/main/java/org/apache/cxf/ws/addressing/EndpointReferenceUtils.java
index 7912092d62e..cd95087fe52 100644
---
a/core/src/main/java/org/apache/cxf/ws/addressing/EndpointReferenceUtils.java
+++
b/core/src/main/java/org/apache/cxf/ws/addressing/EndpointReferenceUtils.java
@@ -51,6 +51,8 @@ import org.w3c.dom.ls.LSInput;
import org.w3c.dom.ls.LSResourceResolver;
import org.xml.sax.InputSource;
+import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
import jakarta.xml.bind.JAXBContext;
import jakarta.xml.bind.JAXBElement;
@@ -488,6 +490,25 @@ public final class EndpointReferenceUtils {
Schema schema = serviceInfo.getProperty(Schema.class.getName(),
Schema.class);
if (schema == null) {
SchemaFactory factory =
SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
+ try {
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING,
Boolean.TRUE);
+ } catch (SAXNotRecognizedException | SAXNotSupportedException e) {
+ LOG.log(Level.WARNING, "The property '" +
XMLConstants.FEATURE_SECURE_PROCESSING
+ + "' is not supported.");
+ }
+
+ try {
+ factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+ } catch (SAXNotRecognizedException | SAXNotSupportedException e) {
+ LOG.log(Level.WARNING, "The property '" +
XMLConstants.ACCESS_EXTERNAL_DTD + "' is not supported.");
+ }
+
+ try {
+ factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
+ } catch (SAXNotRecognizedException | SAXNotSupportedException e) {
+ LOG.log(Level.WARNING, "The property '" +
XMLConstants.ACCESS_EXTERNAL_SCHEMA + "' is not supported.");
+ }
+
Map<String, byte[]> schemaSourcesMap = new LinkedHashMap<>();
Map<String, Source> schemaSourcesMap2 = new LinkedHashMap<>();
diff --git
a/rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/type/XMLTypeCreator.java
b/rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/type/XMLTypeCreator.java
index 85c26c8ade7..abcee6d0bf3 100644
---
a/rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/type/XMLTypeCreator.java
+++
b/rt/databinding/aegis/src/main/java/org/apache/cxf/aegis/type/XMLTypeCreator.java
@@ -126,6 +126,7 @@ public class XMLTypeCreator extends AbstractTypeCreator {
try (InputStream is = XMLTypeCreator.class.getResourceAsStream(path)) {
if (is != null) {
SchemaFactory schemaFactory =
SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
+
schemaFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
Schema aegisSchema = schemaFactory.newSchema(new
StreamSource(is));
AEGIS_DOCUMENT_BUILDER_FACTORY.setSchema(aegisSchema);
}
diff --git a/rt/ws/rm/src/main/java/org/apache/cxf/ws/rm/RMEndpoint.java
b/rt/ws/rm/src/main/java/org/apache/cxf/ws/rm/RMEndpoint.java
index 76ecd7aa30a..7c2609474a0 100644
--- a/rt/ws/rm/src/main/java/org/apache/cxf/ws/rm/RMEndpoint.java
+++ b/rt/ws/rm/src/main/java/org/apache/cxf/ws/rm/RMEndpoint.java
@@ -385,6 +385,7 @@ public class RMEndpoint {
if (rmSchema == null) {
try {
SchemaFactory factory =
SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
+ factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING,
Boolean.TRUE);
javax.xml.transform.Source ad = new
StreamSource(RMEndpoint.class
.getResource("/schemas/wsdl/addressing.xsd")
.openStream(),
diff --git
a/tools/common/src/main/java/org/apache/cxf/tools/common/dom/ExtendedDocumentBuilder.java
b/tools/common/src/main/java/org/apache/cxf/tools/common/dom/ExtendedDocumentBuilder.java
index 747acf1fa59..b8db3b09e8d 100644
---
a/tools/common/src/main/java/org/apache/cxf/tools/common/dom/ExtendedDocumentBuilder.java
+++
b/tools/common/src/main/java/org/apache/cxf/tools/common/dom/ExtendedDocumentBuilder.java
@@ -38,6 +38,8 @@ import javax.xml.validation.SchemaFactory;
import org.w3c.dom.Document;
import org.xml.sax.SAXException;
+import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
import org.apache.cxf.common.logging.LogUtils;
import org.apache.cxf.staxutils.StaxUtils;
@@ -65,6 +67,25 @@ public class ExtendedDocumentBuilder {
public void setValidating(boolean validate) {
if (validate) {
this.schemaFactory =
SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
+ try {
+
schemaFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE);
+ } catch (SAXNotRecognizedException | SAXNotSupportedException e) {
+ LOG.log(Level.WARNING, "The property '" +
XMLConstants.FEATURE_SECURE_PROCESSING
+ + "' is not supported.");
+ }
+
+ try {
+ schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD,
"");
+ } catch (SAXNotRecognizedException | SAXNotSupportedException e) {
+ LOG.log(Level.WARNING, "The property '" +
XMLConstants.ACCESS_EXTERNAL_DTD + "' is not supported.");
+ }
+
+ try {
+ schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA,
"");
+ } catch (SAXNotRecognizedException | SAXNotSupportedException e) {
+ LOG.log(Level.WARNING, "The property '" +
XMLConstants.ACCESS_EXTERNAL_SCHEMA + "' is not supported.");
+ }
+
try {
this.schema = schemaFactory.newSchema(new
StreamSource(getSchemaLocation()));
} catch (SAXException e) {
diff --git
a/tools/wsdlto/databinding/jaxb/src/main/java/org/apache/cxf/tools/wsdlto/databinding/jaxb/JAXBDataBinding.java
b/tools/wsdlto/databinding/jaxb/src/main/java/org/apache/cxf/tools/wsdlto/databinding/jaxb/JAXBDataBinding.java
index c2c371395db..fc9d8c0fb53 100644
---
a/tools/wsdlto/databinding/jaxb/src/main/java/org/apache/cxf/tools/wsdlto/databinding/jaxb/JAXBDataBinding.java
+++
b/tools/wsdlto/databinding/jaxb/src/main/java/org/apache/cxf/tools/wsdlto/databinding/jaxb/JAXBDataBinding.java
@@ -67,6 +67,8 @@ import org.xml.sax.Attributes;
import org.xml.sax.InputSource;
import org.xml.sax.Locator;
import org.xml.sax.SAXException;
+import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
import org.xml.sax.SAXParseException;
import org.xml.sax.helpers.XMLFilterImpl;
@@ -1065,6 +1067,12 @@ public class JAXBDataBinding implements
DataBindingProfile {
final OASISCatalogManager catalog,
final SchemaCollection schemaCollection) throws
ToolException {
SchemaFactory schemaFact =
SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
+ try {
+ schemaFact.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING,
Boolean.TRUE);
+ } catch (SAXNotRecognizedException | SAXNotSupportedException e) {
+ LOG.log(Level.WARNING, "The property '" +
XMLConstants.FEATURE_SECURE_PROCESSING
+ + "' is not supported.");
+ }
schemaFact.setResourceResolver(new LSResourceResolver() {
public LSInput resolveResource(String type,
String namespaceURI,
