Skip to content

Commit d1abc24

Browse files
author
drighetto
committed
Add new method
1 parent 8248f68 commit d1abc24

File tree

6 files changed

+461
-1
lines changed

6 files changed

+461
-1
lines changed

‎pom.xml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@
113113
<charset>${project.build.sourceEncoding}</charset>
114114
<linksource>true</linksource>
115115
<windowtitle>Javadoc</windowtitle>
116-
<bottom>${project.artifactId} - ${project.version}</bottom>
116+
<bottom>Generated on ${maven.build.timestamp}.</bottom>
117117
<javadocDirectory>${basedir}/src/main/javadoc</javadocDirectory>
118118
<docfilessubdirs>true</docfilessubdirs>
119119
</configuration>
@@ -125,6 +125,7 @@
125125
<jdk.target>21</jdk.target>
126126
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
127127
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
128+
<maven.build.timestamp.format>yyyy-MM-dd</maven.build.timestamp.format>
128129
</properties>
129130
<repositories>
130131
<repository>

‎src/main/java/eu/righettod/SecurityUtils.java

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,13 @@
3838
import javax.imageio.ImageIO;
3939
import javax.json.Json;
4040
import javax.json.JsonReader;
41+
import javax.xml.XMLConstants;
4142
import javax.xml.parsers.DocumentBuilder;
4243
import javax.xml.parsers.DocumentBuilderFactory;
4344
import javax.xml.parsers.ParserConfigurationException;
45+
import javax.xml.stream.XMLInputFactory;
46+
import javax.xml.stream.XMLStreamReader;
47+
import javax.xml.stream.events.XMLEvent;
4448
import java.awt.*;
4549
import java.awt.image.BufferedImage;
4650
import java.io.*;
@@ -1187,4 +1191,45 @@ public static boolean isPathSafe(String path) {
11871191
}
11881192
return isSafe;
11891193
}
1194+
1195+
/**
1196+
* Identify if an XML contains any XML comments or have any XSL processing instructions.<br>
1197+
* Stream reader based parsing is used to support large XML tree.
1198+
*
1199+
* @param xmlFilePath Filename of the XML file to check.
1200+
* @return True only if XML comments or XSL processing instructions are identified.
1201+
* @see "https://www.tutorialspoint.com/xml/xml_processing.htm"
1202+
* @see "https://docs.oracle.com/en/java/javase/21/docs/api/java.xml/javax/xml/stream/XMLInputFactory.html"
1203+
* @see "https://portswigger.net/kb/issues/00400700_xml-entity-expansion"
1204+
* @see "https://www.w3.org/Style/styling-XML.en.html"
1205+
*/
1206+
public static boolean isXMLHaveCommentsOrXSLProcessingInstructions(String xmlFilePath) {
1207+
boolean itemsDetected = false;
1208+
try {
1209+
//Ensure that the parser will not be prone XML external entity (XXE) injection or XML entity expansion (XEE) attacks
1210+
XMLInputFactory xmlInputFactory = XMLInputFactory.newFactory();
1211+
xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
1212+
xmlInputFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
1213+
xmlInputFactory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, false);
1214+
xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
1215+
1216+
//Parse file
1217+
try (FileInputStream fis = new FileInputStream(xmlFilePath)) {
1218+
XMLStreamReader reader = xmlInputFactory.createXMLStreamReader(fis);
1219+
int eventType;
1220+
while (reader.hasNext() && !itemsDetected) {
1221+
eventType = reader.next();
1222+
if (eventType == XMLEvent.COMMENT) {
1223+
itemsDetected = true;
1224+
} else if (eventType == XMLEvent.PROCESSING_INSTRUCTION && "xml-stylesheet".equalsIgnoreCase(reader.getPITarget())) {
1225+
itemsDetected = true;
1226+
}
1227+
}
1228+
}
1229+
} catch (Exception e) {
1230+
//In case of error then assume that the check failed
1231+
itemsDetected = true;
1232+
}
1233+
return itemsDetected;
1234+
}
11901235
}

‎src/test/java/eu/righettod/TestSecurityUtils.java

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -558,5 +558,21 @@ public void isPathSafe() {
558558
assertTrue(SecurityUtils.isPathSafe(p), String.format(templateMsgFalsePositive, p));
559559
});
560560
}
561+
562+
@Test
563+
public void isXMLHaveCommentsOrXSLProcessingInstructions() {
564+
//Test detection case for comments
565+
String testFile = getTestFilePath("test-xml-with-comments.xml");
566+
boolean result = SecurityUtils.isXMLHaveCommentsOrXSLProcessingInstructions(testFile);
567+
assertTrue(result, "Comments were expected to be detected!");
568+
//Test detection case for XSL PI
569+
testFile = getTestFilePath("test-xml-with-xsl-pi.xml");
570+
result = SecurityUtils.isXMLHaveCommentsOrXSLProcessingInstructions(testFile);
571+
assertTrue(result, "XSL PI were expected to be detected!");
572+
//Test for the clean case
573+
testFile = getTestFilePath("test-xml-without-comment-or-xsl-pi.xml");
574+
result = SecurityUtils.isXMLHaveCommentsOrXSLProcessingInstructions(testFile);
575+
assertFalse(result, "No Comments or XSL PI were expected to be detected!");
576+
}
561577
}
562578

‎src/test/resources/test-xml-with-comments.xml

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
<?xml version="1.0"?>
2+
<catalog>
3+
<book id="bk101">
4+
<author>Gambardella, Matthew</author>
5+
<title>XML Developer's Guide</title>
6+
<genre>Computer</genre>
7+
<price>44.95</price>
8+
<publish_date>2000-10-01</publish_date>
9+
<description>An in-depth look at creating applications
10+
with XML.
11+
</description>
12+
</book>
13+
<!-- TEST -->
14+
<book id="bk102">
15+
<author>Ralls, Kim</author>
16+
<title>Midnight Rain</title>
17+
<genre>Fantasy</genre>
18+
<price>5.95</price>
19+
<publish_date>2000-12-16</publish_date>
20+
<description>A former architect battles corporate zombies,
21+
an evil sorceress, and her own childhood to become queen
22+
of the world.
23+
</description>
24+
</book>
25+
<book id="bk103">
26+
<author>Corets, Eva</author>
27+
<title>Maeve Ascendant</title>
28+
<genre>Fantasy</genre>
29+
<price>5.95</price>
30+
<publish_date>2000-11-17</publish_date>
31+
<description>After the collapse of a nanotechnology
32+
society in England, the young survivors lay the
33+
foundation for a new society.
34+
</description>
35+
</book>
36+
<book id="bk104">
37+
<author>Corets, Eva</author>
38+
<title>Oberon's Legacy</title>
39+
<genre>Fantasy</genre>
40+
<price>5.95</price>
41+
<publish_date>2001-03-10</publish_date>
42+
<description>In post-apocalypse England, the mysterious
43+
agent known only as Oberon helps to create a new life
44+
for the inhabitants of London. Sequel to Maeve
45+
Ascendant.
46+
</description>
47+
</book>
48+
<book id="bk105">
49+
<author>Corets, Eva</author>
50+
<title>The Sundered Grail</title>
51+
<genre>Fantasy</genre>
52+
<price>5.95</price>
53+
<publish_date>2001-09-10</publish_date>
54+
<description>The two daughters of Maeve, half-sisters,
55+
battle one another for control of England. Sequel to
56+
Oberon's Legacy.
57+
</description>
58+
</book>
59+
<book id="bk106">
60+
<author>Randall, Cynthia</author>
61+
<title>Lover Birds</title>
62+
<genre>Romance</genre>
63+
<price>4.95</price>
64+
<publish_date>2000-09-02</publish_date>
65+
<description>When Carla meets Paul at an ornithology
66+
conference, tempers fly as feathers get ruffled.
67+
</description>
68+
</book>
69+
<book id="bk107">
70+
<author>Thurman, Paula</author>
71+
<title>Splish Splash</title>
72+
<genre>Romance</genre>
73+
<price>4.95</price>
74+
<publish_date>2000-11-02</publish_date>
75+
<description>A deep sea diver finds true love twenty
76+
thousand leagues beneath the sea.
77+
</description>
78+
</book>
79+
<book id="bk108">
80+
<author>Knorr, Stefan</author>
81+
<title>Creepy Crawlies</title>
82+
<genre>Horror</genre>
83+
<price>4.95</price>
84+
<publish_date>2000-12-06</publish_date>
85+
<description>An anthology of horror stories about roaches,
86+
centipedes, scorpions and other insects.
87+
</description>
88+
</book>
89+
<book id="bk109">
90+
<author>Kress, Peter</author>
91+
<title>Paradox Lost</title>
92+
<genre>Science Fiction</genre>
93+
<price>6.95</price>
94+
<publish_date>2000-11-02</publish_date>
95+
<description>After an inadvertant trip through a Heisenberg
96+
Uncertainty Device, James Salway discovers the problems
97+
of being quantum.
98+
</description>
99+
</book>
100+
<book id="bk110">
101+
<author>O'Brien, Tim</author>
102+
<title>Microsoft .NET: The Programming Bible</title>
103+
<genre>Computer</genre>
104+
<price>36.95</price>
105+
<publish_date>2000-12-09</publish_date>
106+
<description>Microsoft's .NET initiative is explored in
107+
detail in this deep programmer's reference.
108+
</description>
109+
</book>
110+
<book id="bk111">
111+
<author>O'Brien, Tim</author>
112+
<title>MSXML3: A Comprehensive Guide</title>
113+
<genre>Computer</genre>
114+
<price>36.95</price>
115+
<publish_date>2000-12-01</publish_date>
116+
<description>The Microsoft MSXML3 parser is covered in
117+
detail, with attention to XML DOM interfaces, XSLT processing,
118+
SAX and more.
119+
</description>
120+
</book>
121+
<book id="bk112">
122+
<author>Galos, Mike</author>
123+
<title>Visual Studio 7: A Comprehensive Guide</title>
124+
<genre>Computer</genre>
125+
<price>49.95</price>
126+
<publish_date>2001-04-16</publish_date>
127+
<description>Microsoft Visual Studio 7 is explored in depth,
128+
looking at how Visual Basic, Visual C++, C#, and ASP+ are
129+
integrated into a comprehensive development
130+
environment.
131+
</description>
132+
</book>
133+
</catalog>

‎src/test/resources/test-xml-with-xsl-pi.xml

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
<?xml version="1.0"?>
2+
<?xml-stylesheet type="text/xsl" href="test.xslt" ?>
3+
<catalog>
4+
<book id="bk101">
5+
<author>Gambardella, Matthew</author>
6+
<title>XML Developer's Guide</title>
7+
<genre>Computer</genre>
8+
<price>44.95</price>
9+
<publish_date>2000-10-01</publish_date>
10+
<description>An in-depth look at creating applications
11+
with XML.
12+
</description>
13+
</book>
14+
<book id="bk102">
15+
<author>Ralls, Kim</author>
16+
<title>Midnight Rain</title>
17+
<genre>Fantasy</genre>
18+
<price>5.95</price>
19+
<publish_date>2000-12-16</publish_date>
20+
<description>A former architect battles corporate zombies,
21+
an evil sorceress, and her own childhood to become queen
22+
of the world.
23+
</description>
24+
</book>
25+
<book id="bk103">
26+
<author>Corets, Eva</author>
27+
<title>Maeve Ascendant</title>
28+
<genre>Fantasy</genre>
29+
<price>5.95</price>
30+
<publish_date>2000-11-17</publish_date>
31+
<description>After the collapse of a nanotechnology
32+
society in England, the young survivors lay the
33+
foundation for a new society.
34+
</description>
35+
</book>
36+
<book id="bk104">
37+
<author>Corets, Eva</author>
38+
<title>Oberon's Legacy</title>
39+
<genre>Fantasy</genre>
40+
<price>5.95</price>
41+
<publish_date>2001-03-10</publish_date>
42+
<description>In post-apocalypse England, the mysterious
43+
agent known only as Oberon helps to create a new life
44+
for the inhabitants of London. Sequel to Maeve
45+
Ascendant.
46+
</description>
47+
</book>
48+
<book id="bk105">
49+
<author>Corets, Eva</author>
50+
<title>The Sundered Grail</title>
51+
<genre>Fantasy</genre>
52+
<price>5.95</price>
53+
<publish_date>2001-09-10</publish_date>
54+
<description>The two daughters of Maeve, half-sisters,
55+
battle one another for control of England. Sequel to
56+
Oberon's Legacy.
57+
</description>
58+
</book>
59+
<book id="bk106">
60+
<author>Randall, Cynthia</author>
61+
<title>Lover Birds</title>
62+
<genre>Romance</genre>
63+
<price>4.95</price>
64+
<publish_date>2000-09-02</publish_date>
65+
<description>When Carla meets Paul at an ornithology
66+
conference, tempers fly as feathers get ruffled.
67+
</description>
68+
</book>
69+
<book id="bk107">
70+
<author>Thurman, Paula</author>
71+
<title>Splish Splash</title>
72+
<genre>Romance</genre>
73+
<price>4.95</price>
74+
<publish_date>2000-11-02</publish_date>
75+
<description>A deep sea diver finds true love twenty
76+
thousand leagues beneath the sea.
77+
</description>
78+
</book>
79+
<book id="bk108">
80+
<author>Knorr, Stefan</author>
81+
<title>Creepy Crawlies</title>
82+
<genre>Horror</genre>
83+
<price>4.95</price>
84+
<publish_date>2000-12-06</publish_date>
85+
<description>An anthology of horror stories about roaches,
86+
centipedes, scorpions and other insects.
87+
</description>
88+
</book>
89+
<book id="bk109">
90+
<author>Kress, Peter</author>
91+
<title>Paradox Lost</title>
92+
<genre>Science Fiction</genre>
93+
<price>6.95</price>
94+
<publish_date>2000-11-02</publish_date>
95+
<description>After an inadvertant trip through a Heisenberg
96+
Uncertainty Device, James Salway discovers the problems
97+
of being quantum.
98+
</description>
99+
</book>
100+
<book id="bk110">
101+
<author>O'Brien, Tim</author>
102+
<title>Microsoft .NET: The Programming Bible</title>
103+
<genre>Computer</genre>
104+
<price>36.95</price>
105+
<publish_date>2000-12-09</publish_date>
106+
<description>Microsoft's .NET initiative is explored in
107+
detail in this deep programmer's reference.
108+
</description>
109+
</book>
110+
<book id="bk111">
111+
<author>O'Brien, Tim</author>
112+
<title>MSXML3: A Comprehensive Guide</title>
113+
<genre>Computer</genre>
114+
<price>36.95</price>
115+
<publish_date>2000-12-01</publish_date>
116+
<description>The Microsoft MSXML3 parser is covered in
117+
detail, with attention to XML DOM interfaces, XSLT processing,
118+
SAX and more.
119+
</description>
120+
</book>
121+
<book id="bk112">
122+
<author>Galos, Mike</author>
123+
<title>Visual Studio 7: A Comprehensive Guide</title>
124+
<genre>Computer</genre>
125+
<price>49.95</price>
126+
<publish_date>2001-04-16</publish_date>
127+
<description>Microsoft Visual Studio 7 is explored in depth,
128+
looking at how Visual Basic, Visual C++, C#, and ASP+ are
129+
integrated into a comprehensive development
130+
environment.
131+
</description>
132+
</book>
133+
</catalog>

0 commit comments

Comments
 (0)