-
Notifications
You must be signed in to change notification settings - Fork 2.7k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Added XmlUtils class. - Added unit test. - Added XXE test resource. - Refactored JAXB unmarshalling globally to prevent XXE attacks. - Refactored duplicated/legacy code. - Cleaned up commented code. - Switched from FileInputStream back to StreamSource in AuthorizerFactoryBean. - This closes #2134
- Loading branch information
Showing
22 changed files
with
396 additions
and
220 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
44 changes: 44 additions & 0 deletions
44
nifi-commons/nifi-security-utils/src/main/java/org/apache/nifi/security/xml/XmlUtils.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,44 @@ | ||
/* | ||
* Licensed to the Apache Software Foundation (ASF) under one or more | ||
* contributor license agreements. See the NOTICE file distributed with | ||
* this work for additional information regarding copyright ownership. | ||
* The ASF licenses this file to You under the Apache License, Version 2.0 | ||
* (the "License"); you may not use this file except in compliance with | ||
* the License. You may obtain a copy of the License at | ||
* | ||
* http://www.apache.org/licenses/LICENSE-2.0 | ||
* | ||
* Unless required by applicable law or agreed to in writing, software | ||
* distributed under the License is distributed on an "AS IS" BASIS, | ||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
* See the License for the specific language governing permissions and | ||
* limitations under the License. | ||
*/ | ||
package org.apache.nifi.security.xml; | ||
|
||
import javax.xml.stream.XMLInputFactory; | ||
import javax.xml.stream.XMLStreamException; | ||
import javax.xml.stream.XMLStreamReader; | ||
import javax.xml.transform.stream.StreamSource; | ||
import java.io.InputStream; | ||
|
||
public class XmlUtils { | ||
|
||
public static XMLStreamReader createSafeReader(InputStream inputStream) throws XMLStreamException { | ||
if (inputStream == null) { | ||
throw new IllegalArgumentException("The provided input stream cannot be null"); | ||
} | ||
return createSafeReader(new StreamSource(inputStream)); | ||
} | ||
|
||
public static XMLStreamReader createSafeReader(StreamSource source) throws XMLStreamException { | ||
if (source == null) { | ||
throw new IllegalArgumentException("The provided source cannot be null"); | ||
} | ||
|
||
XMLInputFactory xif = XMLInputFactory.newFactory(); | ||
xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false); | ||
xif.setProperty(XMLInputFactory.SUPPORT_DTD, false); | ||
return xif.createXMLStreamReader(source); | ||
} | ||
} |
96 changes: 96 additions & 0 deletions
96
...mons/nifi-security-utils/src/test/groovy/org/apache/nifi/security/xml/XmlUtilsTest.groovy
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,96 @@ | ||
/* | ||
* Licensed to the Apache Software Foundation (ASF) under one or more | ||
* contributor license agreements. See the NOTICE file distributed with | ||
* this work for additional information regarding copyright ownership. | ||
* The ASF licenses this file to You under the Apache License, Version 2.0 | ||
* (the "License"); you may not use this file except in compliance with | ||
* the License. You may obtain a copy of the License at | ||
* | ||
* http://www.apache.org/licenses/LICENSE-2.0 | ||
* | ||
* Unless required by applicable law or agreed to in writing, software | ||
* distributed under the License is distributed on an "AS IS" BASIS, | ||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
* See the License for the specific language governing permissions and | ||
* limitations under the License. | ||
*/ | ||
package org.apache.nifi.security.xml | ||
|
||
import org.junit.After | ||
import org.junit.Before | ||
import org.junit.BeforeClass | ||
import org.junit.Test | ||
import org.junit.runner.RunWith | ||
import org.junit.runners.JUnit4 | ||
import org.slf4j.Logger | ||
import org.slf4j.LoggerFactory | ||
|
||
import javax.xml.bind.JAXBContext | ||
import javax.xml.bind.UnmarshalException | ||
import javax.xml.bind.Unmarshaller | ||
import javax.xml.bind.annotation.XmlAccessType | ||
import javax.xml.bind.annotation.XmlAccessorType | ||
import javax.xml.bind.annotation.XmlAttribute | ||
import javax.xml.bind.annotation.XmlRootElement | ||
import javax.xml.stream.XMLStreamReader | ||
|
||
import static groovy.test.GroovyAssert.shouldFail | ||
|
||
@RunWith(JUnit4.class) | ||
class XmlUtilsTest { | ||
private static final Logger logger = LoggerFactory.getLogger(XmlUtilsTest.class) | ||
|
||
@BeforeClass | ||
static void setUpOnce() throws Exception { | ||
logger.metaClass.methodMissing = { String name, args -> | ||
logger.info("[${name?.toUpperCase()}] ${(args as List).join(" ")}") | ||
} | ||
} | ||
|
||
@Before | ||
void setUp() throws Exception { | ||
|
||
} | ||
|
||
@After | ||
void tearDown() throws Exception { | ||
|
||
} | ||
|
||
@Test | ||
void testShouldHandleXXEInUnmarshal() { | ||
// Arrange | ||
final String XXE_TEMPLATE_FILEPATH = "src/test/resources/xxe_template.xml" | ||
InputStream templateStream = new File(XXE_TEMPLATE_FILEPATH).newInputStream() | ||
|
||
JAXBContext context = JAXBContext.newInstance(XmlObject.class) | ||
|
||
// Act | ||
def msg = shouldFail(UnmarshalException) { | ||
Unmarshaller unmarshaller = context.createUnmarshaller() | ||
XMLStreamReader xsr = XmlUtils.createSafeReader(templateStream) | ||
def parsed = unmarshaller.unmarshal(xsr, XmlObject.class) | ||
logger.info("Unmarshalled ${parsed.toString()}") | ||
} | ||
|
||
// Assert | ||
logger.expected(msg) | ||
assert msg =~ "XMLStreamException: ParseError " | ||
} | ||
} | ||
|
||
@XmlAccessorType( XmlAccessType.NONE ) | ||
@XmlRootElement(name = "object") | ||
class XmlObject { | ||
@XmlAttribute | ||
String name | ||
|
||
@XmlAttribute | ||
String description | ||
|
||
@XmlAttribute | ||
String groupId | ||
|
||
@XmlAttribute | ||
String timestamp | ||
} |
7 changes: 7 additions & 0 deletions
7
nifi-commons/nifi-security-utils/src/test/resources/xxe_template.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,7 @@ | ||
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><!DOCTYPE object [<!ENTITY xxe SYSTEM "file:///etc/passwd" >]> | ||
<object> | ||
<name>&xxe;</name> | ||
<description>Arbitrary XML that has an XXE attack present.</description> | ||
<groupId>3a204982-015e-1000-eaa2-19d352ec8394</groupId> | ||
<timestamp>09/05/2017 14:51:01 PDT</timestamp> | ||
</object> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.