[
https://issues.apache.org/jira/browse/RANGER-5477?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18057344#comment-18057344
]
Bhavesh Amre commented on RANGER-5477:
--------------------------------------
Ranger plugin installation fails in Docker environments due to a
{{TransformerConfigurationException}} thrown during XML configuration updates.
h3. Root Cause
As part of the RANGER-5477 security fix, SAX parser features were applied to
{{{}TransformerFactory{}}}. However, {{TransformerFactory}} does not support
SAX-specific features, causing XML transformation to fail during plugin setup.
h3. Impact
* Ranger plugin installation aborts during XML configuration changes
* {{XmlConfigChanger}} exits with an error
* Affects HDFS, YARN, Hive, and other Ranger plugins
h3. Fix
Replace incompatible {{setFeature()}} calls with the supported JAXP mechanism
using {{{}setAttribute(){}}}:
* Use {{ACCESS_EXTERNAL_DTD}} and {{ACCESS_EXTERNAL_STYLESHEET}} to restrict
external entity access during XML transformation
* Maintains XXE protection while ensuring compatibility across JDK versions
and TransformerFactory implementations
> XML External Entity Injection Security issue in Ranger
> ------------------------------------------------------
>
> Key: RANGER-5477
> URL: https://issues.apache.org/jira/browse/RANGER-5477
> Project: Ranger
> Issue Type: Bug
> Components: Ranger
> Reporter: Dhaval Shah
> Assignee: Bhavesh Amre
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> Scan has identified XXE as a critical finding.
> {code:java}
> factory.setFeature("http://xml.org/sax/features/external-general-entities";,
> false);
> factory.setFeature("http://xml.org/sax/features/external-parameter-entities";,
> false);
> factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl";,
> true);{code}
>
> {code:java}
> TransformerFactory tfactory = TransformerFactory.newInstance();
> tfactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING,
> Boolean.TRUE);
> Transformer transformer = tfactory.newTransformer();
> transformer.setOutputProperty(OutputKeys.INDENT, "yes");
>
> transformer.setOutputProperty("{http://xml.apache.org/xslt}indent-amount";,
> "4");
>
> DOMSource source = new DOMSource(doc);
> FileOutputStream out = new FileOutputStream(outFile);
> StreamResult result = new StreamResult(out);
> transformer.transform(source, result);
> out.close(); {code}
> file:
> h4.
> /agents-installer/src/main/java/org/apache/ranger/utils/install/XmlConfigChanger.java
> line number.
>
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
