Ruben Q L created CALCITE-7790:
----------------------------------
Summary: XmlFunctions: XMLTRANSFORM should parse its XML argument
through the shared DocumentBuilder and set explicit JAXP external-access
attributes on the TransformerFactory
Key: CALCITE-7790
URL: https://issues.apache.org/jira/browse/CALCITE-7790
Project: Calcite
Issue Type: Task
Reporter: Ruben Q L
Fix For: 1.43.0
{{XmlFunctions.xmlTransform}} currently hands its XML argument to
{{TransformerFactory}} as a raw StreamSource wrapping a StringReader, unlike
the other functions in this class ({{EXTRACT_VALUE}}, {{EXTRACT_XML}},
{{EXISTSNODE}}) which parse the XML argument through the shared, hardened
{{DocumentBuilder}} set up in CALCITE-5263. This inconsistency means the
DOCTYPE and entity-handling policy configured on {{DOCUMENT_BUILDER_FACTORY}}
does not apply to XMLTRANSFORM; DTD and entity handling on the transform path
is governed entirely by the reader defaults of whichever JAXP provider is
resolved by {{TransformerFactory.newInstance()}}. Route the XML argument
through {{getDocumentNode}} (as a {{DOMSource}}) so all XML inputs in
{{XmlFunctions}} are parsed with the same configuration.
Separately, the shared {{TransformerFactory}} initializer sets
{{FEATURE_SECURE_PROCESSING=true}} but does not set the JAXP 1.5 attributes
{{ACCESS_EXTERNAL_DTD}} and {{ACCESS_EXTERNAL_STYLESHEET}}. On the JDK's
built-in transformer, secure processing already restricts those attributes to
the empty string as a documented side effect, but
{{TransformerFactory.newInstance()}} is a {{ServiceLoader}} lookup and may
resolve a different implementation on some classpaths where that side effect
does not apply. Set the attributes explicitly, and fail the initializer if the
provider does not accept them (the same fail-closed pattern that
{{DOCUMENT_BUILDER_FACTORY}} already uses for disallow-doctype-decl).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
