diff --git a/integration/pom.xml b/integration/pom.xml index daee20400..495f23c32 100644 --- a/integration/pom.xml +++ b/integration/pom.xml @@ -45,6 +45,10 @@ + + org.apache.commons + commons-secure-xml + org.apache.wss4j wss4j-ws-security-common diff --git a/integration/src/test/java/org/apache/wss4j/integration/test/kerberos/KerberosTest.java b/integration/src/test/java/org/apache/wss4j/integration/test/kerberos/KerberosTest.java index 228db1f52..ac965ae51 100644 --- a/integration/src/test/java/org/apache/wss4j/integration/test/kerberos/KerberosTest.java +++ b/integration/src/test/java/org/apache/wss4j/integration/test/kerberos/KerberosTest.java @@ -42,6 +42,9 @@ import javax.xml.transform.dom.DOMSource; import javax.xml.transform.stream.StreamResult; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; +import org.apache.commons.xml.secure.SecureTransformerFactory; +import org.apache.commons.xml.secure.SecureXMLInputFactory; import org.apache.kerby.kerberos.kerb.server.SimpleKdcServer; import org.apache.wss4j.common.ext.WSSecurityException; import org.apache.wss4j.common.kerberos.KerberosContextAndServiceNameCallback; @@ -90,8 +93,8 @@ public class KerberosTest { private static final org.slf4j.Logger LOG = org.slf4j.LoggerFactory.getLogger(KerberosTest.class); - private static final XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance(); - private static final TransformerFactory TRANSFORMER_FACTORY = TransformerFactory.newInstance(); + private static final XMLInputFactory xmlInputFactory = SecureXMLInputFactory.newInstance(); + private static final TransformerFactory TRANSFORMER_FACTORY = SecureTransformerFactory.newInstance(); private static DocumentBuilderFactory dbf; private static boolean runTests = true; @@ -135,8 +138,7 @@ public static void setUp() throws Exception { runTests = false; } - dbf = DocumentBuilderFactory.newInstance(); - dbf.setNamespaceAware(true); + dbf = SecureDocumentBuilderFactory.newNSInstance(); dbf.setIgnoringComments(false); dbf.setCoalescing(false); dbf.setIgnoringElementContentWhitespace(false); diff --git a/parent/pom.xml b/parent/pom.xml index eb3d51e79..484204eb9 100644 --- a/parent/pom.xml +++ b/parent/pom.xml @@ -202,6 +202,11 @@ jakarta.xml.bind-api ${xml.bind.api.version} + + org.apache.commons + commons-secure-xml + 1.0.0 + diff --git a/ws-security-common/pom.xml b/ws-security-common/pom.xml index a30e173b7..ac03c3247 100644 --- a/ws-security-common/pom.xml +++ b/ws-security-common/pom.xml @@ -212,6 +212,10 @@ ${opensaml.version} compile + + org.apache.commons + commons-secure-xml + org.ehcache ehcache diff --git a/ws-security-common/src/main/java/org/apache/wss4j/common/util/XMLUtils.java b/ws-security-common/src/main/java/org/apache/wss4j/common/util/XMLUtils.java index 136b18410..33e7f5ed1 100644 --- a/ws-security-common/src/main/java/org/apache/wss4j/common/util/XMLUtils.java +++ b/ws-security-common/src/main/java/org/apache/wss4j/common/util/XMLUtils.java @@ -27,7 +27,6 @@ import java.util.Collections; import java.util.List; -import javax.xml.XMLConstants; import javax.xml.transform.Source; import javax.xml.transform.Transformer; import javax.xml.transform.TransformerException; @@ -44,8 +43,11 @@ import org.w3c.dom.NamedNodeMap; import org.w3c.dom.Node; import org.w3c.dom.Text; + import org.xml.sax.InputSource; +import org.apache.commons.xml.secure.SecureTransformerFactory; + public final class XMLUtils { public static final String XMLNS_NS = "http://www.w3.org/2000/xmlns/"; @@ -139,16 +141,7 @@ public static void elementToStream(Element element, OutputStream out) throws TransformerException { DOMSource source = new DOMSource(element); StreamResult result = new StreamResult(out); - - TransformerFactory transFactory = TransformerFactory.newInstance(); - transFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); - try { - transFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); - transFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); - } catch (IllegalArgumentException ex) { //NOPMD - // ignore - } - + TransformerFactory transFactory = SecureTransformerFactory.newInstance(); Transformer transformer = transFactory.newTransformer(); transformer.transform(source, result); } diff --git a/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java b/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java index b63cd2c91..68140aa3c 100644 --- a/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java +++ b/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java @@ -21,7 +21,10 @@ import javax.xml.parsers.DocumentBuilder; import javax.xml.parsers.DocumentBuilderFactory; + import jakarta.xml.soap.MessageFactory; + +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import java.io.ByteArrayInputStream; import java.io.InputStream; @@ -41,15 +44,14 @@ public class SOAPUtil { private static final org.slf4j.Logger LOG = org.slf4j.LoggerFactory.getLogger(SOAPUtil.class); - private static DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); + private static DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newNSInstance(); private static MessageFactory saajFactory = null; static { - factory.setNamespaceAware(true); try { saajFactory = MessageFactory.newInstance(); } catch (Exception e) { - LOG.debug("can't create SAAJ MessageFactory", e); + LOG.debug("Can't create SAAJ MessageFactory", e); } } diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/AbstractSAMLCallbackHandler.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/AbstractSAMLCallbackHandler.java index 3bdd0bc2a..97ed3935f 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/AbstractSAMLCallbackHandler.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/AbstractSAMLCallbackHandler.java @@ -20,6 +20,7 @@ package org.apache.wss4j.dom.common; import org.apache.wss4j.dom.WSConstants; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.crypto.Crypto; import org.apache.wss4j.common.saml.SAMLCallback; import org.apache.wss4j.common.saml.bean.ActionBean; @@ -235,8 +236,7 @@ protected KeyInfoBean createKeyInfo() throws Exception { } else if (statement == Statement.ATTR) { // Build a new Document DocumentBuilderFactory docBuilderFactory = - DocumentBuilderFactory.newInstance(); - docBuilderFactory.setNamespaceAware(true); + SecureDocumentBuilderFactory.newNSInstance(); DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder(); Document doc = docBuilder.newDocument(); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/SAMLElementCallbackHandler.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/SAMLElementCallbackHandler.java index 3ff1e92a2..0d13fa7de 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/SAMLElementCallbackHandler.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/SAMLElementCallbackHandler.java @@ -26,6 +26,7 @@ import javax.xml.parsers.DocumentBuilderFactory; import org.apache.wss4j.common.saml.SamlAssertionWrapper; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.saml.SAMLCallback; import org.apache.wss4j.common.saml.SAMLUtil; import org.apache.wss4j.common.saml.builder.SAML1Constants; @@ -75,7 +76,7 @@ private Element getSAMLAssertion() throws Exception { SamlAssertionWrapper samlAssertionWrapper = new SamlAssertionWrapper(samlCallback); - DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); + DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); return samlAssertionWrapper.toDOM(factory.newDocumentBuilder().newDocument()); } diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java index f95a29509..bff157992 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java @@ -24,6 +24,7 @@ import org.apache.wss4j.dom.common.KeystoreCallbackHandler; import org.apache.wss4j.dom.engine.WSSecurityEngine; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.crypto.Crypto; import org.apache.wss4j.common.crypto.CryptoFactory; import org.apache.wss4j.common.ext.WSSecurityException; @@ -120,8 +121,7 @@ public void testSignatureEmailAddress() throws Exception { outputString.replace("1.2.840.113549.1.9.1=#16125765726e6572406578616d706c652e636f6d", "EMAILADDRESS=Werner@example.com"); - DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); - dbf.setNamespaceAware(true); + DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newNSInstance(); InputStream is = new ByteArrayInputStream(outputString.getBytes()); Document parsedDoc = dbf.newDocumentBuilder().parse(is); verify(parsedDoc); @@ -148,8 +148,7 @@ public void testSignatureOtherEmailAddress() throws Exception { outputString.replace("1.2.840.113549.1.9.1=#16125765726e6572406578616d706c652e636f6d", "E=Werner@example.com"); - DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); - dbf.setNamespaceAware(true); + DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newNSInstance(); InputStream is = new ByteArrayInputStream(outputString.getBytes()); Document parsedDoc = dbf.newDocumentBuilder().parse(is); verify(parsedDoc); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/handler/CustomTokenTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/handler/CustomTokenTest.java index 03495186e..05f0bbce6 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/handler/CustomTokenTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/handler/CustomTokenTest.java @@ -28,6 +28,7 @@ import javax.security.auth.callback.UnsupportedCallbackException; import javax.xml.parsers.DocumentBuilderFactory; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.ext.WSPasswordCallback; import org.apache.wss4j.common.util.SOAPUtil; import org.apache.wss4j.common.util.XMLUtils; @@ -58,8 +59,7 @@ public class CustomTokenTest { @Test public void testCustomTokenTimestamp() throws Exception { // Create a Timestamp manually - DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); - dbf.setNamespaceAware(true); + DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newNSInstance(); Document timestampDoc = dbf.newDocumentBuilder().newDocument(); WSSecTimestamp timestamp = new WSSecTimestamp(timestampDoc); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePrefixListTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePrefixListTest.java index 63521643e..911bc4a67 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePrefixListTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePrefixListTest.java @@ -32,6 +32,7 @@ import javax.xml.parsers.DocumentBuilder; import javax.xml.parsers.DocumentBuilderFactory; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.crypto.Crypto; import org.apache.wss4j.common.crypto.CryptoFactory; import org.apache.wss4j.common.crypto.CryptoType; @@ -72,8 +73,7 @@ public void testDuplicatePrefixListValues() throws Exception { Document doc = null; try (InputStream inputStream = Loader.getResource("org/apache/wss4j/dom/message/SignaturePrefixListMessage.xml").openStream()) { - DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); - factory.setNamespaceAware(true); + DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newNSInstance(); DocumentBuilder builder = factory.newDocumentBuilder(); doc = builder.parse(inputStream); } diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignatureTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignatureTest.java index 06bb4e9f9..128f13db5 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignatureTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignatureTest.java @@ -35,6 +35,7 @@ import javax.xml.parsers.DocumentBuilder; import javax.xml.parsers.DocumentBuilderFactory; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.WSEncryptionPart; import org.apache.wss4j.common.bsp.BSPRule; import org.apache.wss4j.common.crypto.Crypto; @@ -1032,8 +1033,7 @@ public void testCustomKeyInfoElementCreation() throws Exception { // Create the KeyInfo DocumentBuilderFactory docBuilderFactory = - DocumentBuilderFactory.newInstance(); - docBuilderFactory.setNamespaceAware(true); + SecureDocumentBuilderFactory.newNSInstance(); DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder(); Document keyInfoDoc = docBuilder.newDocument(); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/DerivedKeyTokenTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/DerivedKeyTokenTest.java index 723997990..5d8fa3ec1 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/DerivedKeyTokenTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/DerivedKeyTokenTest.java @@ -19,6 +19,7 @@ package org.apache.wss4j.dom.message.token; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.bsp.BSPEnforcer; @@ -93,9 +94,8 @@ private static org.w3c.dom.Document createReferenceDocument( final java.io.InputStream in = new java.io.ByteArrayInputStream( template.replaceFirst("PLACEHOLDER1", placeholder1) .replaceFirst("PLACEHOLDER2", placeholder2).getBytes()); - final javax.xml.parsers.DocumentBuilderFactory factory = javax.xml.parsers.DocumentBuilderFactory - .newInstance(); - factory.setNamespaceAware(true); + final javax.xml.parsers.DocumentBuilderFactory factory = SecureDocumentBuilderFactory + .newNSInstance(); final javax.xml.parsers.DocumentBuilder builder = factory .newDocumentBuilder(); return builder.parse(in); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/ReferenceTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/ReferenceTest.java index 508aa05c7..406eb6500 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/ReferenceTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/ReferenceTest.java @@ -19,6 +19,7 @@ package org.apache.wss4j.dom.message.token; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.ext.WSSecurityException; import org.apache.wss4j.common.token.Reference; @@ -155,8 +156,7 @@ public void testHashcode() throws Exception{ ).getBytes() ); final javax.xml.parsers.DocumentBuilderFactory factory = - javax.xml.parsers.DocumentBuilderFactory.newInstance(); - factory.setNamespaceAware(true); + SecureDocumentBuilderFactory.newNSInstance(); final javax.xml.parsers.DocumentBuilder builder = factory.newDocumentBuilder(); return builder.parse(in); } diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenTest.java index 39c77cb50..5acea98e1 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenTest.java @@ -35,6 +35,7 @@ import javax.security.auth.callback.CallbackHandler; import javax.xml.parsers.DocumentBuilderFactory; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.bsp.BSPRule; import org.apache.wss4j.common.crypto.Crypto; import org.apache.wss4j.common.crypto.CryptoFactory; @@ -1029,8 +1030,7 @@ public void testAssertionWrapper() throws Exception { SAMLUtil.doSAMLCallback(callbackHandler, samlCallback); SamlAssertionWrapper samlAssertion = new SamlAssertionWrapper(samlCallback); - DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); - dbf.setNamespaceAware(true); + DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newNSInstance(); Document doc = dbf.newDocumentBuilder().newDocument(); String assertionString = DOM2Writer.nodeToString(samlAssertion.toDOM(doc)); @@ -1059,8 +1059,7 @@ public void testAssertionWrapperNoDocument() throws Exception { // Convert String to DOM + into an assertionWrapper InputStream in = new ByteArrayInputStream(assertionString.getBytes()); - DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); - dbf.setNamespaceAware(true); + DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newNSInstance(); Document newDoc = dbf.newDocumentBuilder().parse(in); SamlAssertionWrapper newAssertion = diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SignedSamlTokenHOKTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SignedSamlTokenHOKTest.java index f556528d1..c4a55243c 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SignedSamlTokenHOKTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SignedSamlTokenHOKTest.java @@ -32,6 +32,7 @@ import org.apache.wss4j.dom.engine.WSSecurityEngineResult; import org.apache.wss4j.dom.handler.RequestData; import org.apache.wss4j.dom.handler.WSHandlerResult; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.bsp.BSPRule; import org.apache.wss4j.common.crypto.Crypto; import org.apache.wss4j.common.crypto.CryptoFactory; @@ -710,8 +711,7 @@ public void testX509DataAndKeyValue() throws Exception { // Create the KeyInfo DocumentBuilderFactory docBuilderFactory = - DocumentBuilderFactory.newInstance(); - docBuilderFactory.setNamespaceAware(true); + SecureDocumentBuilderFactory.newNSInstance(); DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder(); Document keyInfoDoc = docBuilder.newDocument(); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/ext/AssertionSigningTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/ext/AssertionSigningTest.java index 15d4d7e63..c6b7406aa 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/ext/AssertionSigningTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/ext/AssertionSigningTest.java @@ -24,6 +24,7 @@ import javax.xml.parsers.DocumentBuilderFactory; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.crypto.Crypto; import org.apache.wss4j.common.crypto.CryptoType; import org.apache.wss4j.common.crypto.Merlin; @@ -81,8 +82,7 @@ public AssertionSigningTest() throws Exception { input.close(); ((Merlin) issuerCrypto).setKeyStore(keyStore); - dbf = DocumentBuilderFactory.newInstance(); - dbf.setNamespaceAware(true); + dbf = SecureDocumentBuilderFactory.newNSInstance(); } /** diff --git a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java index cfd834959..060f5a995 100644 --- a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java +++ b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java @@ -18,6 +18,7 @@ */ package org.apache.wss4j.policy.stax.test; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.neethi.builders.AssertionBuilder; import org.apache.wss4j.common.crypto.WSProviderConfig; import org.apache.wss4j.common.ext.WSSecurityException; @@ -82,8 +83,7 @@ protected PolicyEnforcer buildAndStartPolicyEngine(String policyString, boolean protected PolicyEnforcer buildAndStartPolicyEngine( String policyString, boolean replacePolicyElement, List> customAssertionBuilders) throws ParserConfigurationException, SAXException, IOException, WSSPolicyException { - DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance(); - documentBuilderFactory.setNamespaceAware(true); + DocumentBuilderFactory documentBuilderFactory = SecureDocumentBuilderFactory.newNSInstance(); documentBuilderFactory.setValidating(false); DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder(); Document document = documentBuilder.parse( diff --git a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AsymmetricBindingIntegrationTest.java b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AsymmetricBindingIntegrationTest.java index 7a4711a8c..421a06974 100644 --- a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AsymmetricBindingIntegrationTest.java +++ b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AsymmetricBindingIntegrationTest.java @@ -30,10 +30,10 @@ import javax.xml.namespace.QName; import javax.xml.stream.XMLStreamException; import javax.xml.transform.Transformer; -import javax.xml.transform.TransformerFactory; import javax.xml.transform.dom.DOMSource; import javax.xml.transform.stream.StreamResult; +import org.apache.commons.xml.secure.SecureTransformerFactory; import org.apache.wss4j.common.bsp.BSPRule; import org.apache.wss4j.common.crypto.CryptoType; import org.apache.wss4j.common.crypto.Merlin; @@ -154,7 +154,7 @@ public void testIncludeTimestampPolicy() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -297,7 +297,7 @@ public void testIncludeTimestampPolicy2ndAlternative() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -404,7 +404,7 @@ public void testIncludeTimestampPolicyNegativeTest() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -532,7 +532,7 @@ public void testIncludeTimestampAndSignedUsernameSupportingTokenPolicy() throws Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -654,7 +654,7 @@ public void testIncludeTimestampAndSignedUsernameSupportingTokenPolicyNegativeTe Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -783,7 +783,7 @@ public void testIncludeTimestampAndSignedUsernameSupportingTokenPolicyNegativeTe Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -904,7 +904,7 @@ public void testIncludeTimestampAndProtectionOrderEncryptBeforeSignAndSignedUser Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1016,7 +1016,7 @@ public void testSignatureAlgorithmSuiteNegative() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1136,7 +1136,7 @@ public void testC14NAlgorithmSuiteNegative() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1253,7 +1253,7 @@ public void testEncryptionAlgorithmSuiteNegative() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1369,7 +1369,7 @@ public void testPolicyReenabledRSA15KeyTransportAlgorithm() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1478,7 +1478,7 @@ public void testSignatureProtectionPolicy() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1587,7 +1587,7 @@ public void testSignatureProtectionPolicyNegative1() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1701,7 +1701,7 @@ public void testSignatureProtectionPolicyNegative2() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1829,7 +1829,7 @@ public void testEntireHeaderAndBodySignature() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1930,7 +1930,7 @@ public void testEntireHeaderAndBodySignatureNegative() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -2039,7 +2039,7 @@ public void testEntireHeaderAndBodySignatureNegative2() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -2301,7 +2301,7 @@ public void testTokenScenario() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -2429,7 +2429,7 @@ public void testTokenScenarioLateEncryption() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -2537,7 +2537,7 @@ public void testRecipientTokenInclusionAlwaysToRecipientPolicy() throws Exceptio Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -2651,7 +2651,7 @@ public void testInitiatorTokenInclusionAlwaysToRecipientPolicy() throws Exceptio Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -2764,7 +2764,7 @@ public void testSignBeforeEncryptNegativeTest() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -2878,7 +2878,7 @@ public void testEncryptBeforeSigningNegativeTest() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override diff --git a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/TransportBindingIntegrationTest.java b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/TransportBindingIntegrationTest.java index 2d83be4ad..e8d629b40 100644 --- a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/TransportBindingIntegrationTest.java +++ b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/TransportBindingIntegrationTest.java @@ -29,10 +29,10 @@ import javax.xml.namespace.QName; import javax.xml.stream.XMLStreamException; import javax.xml.transform.Transformer; -import javax.xml.transform.TransformerFactory; import javax.xml.transform.dom.DOMSource; import javax.xml.transform.stream.StreamResult; +import org.apache.commons.xml.secure.SecureTransformerFactory; import org.apache.wss4j.common.bsp.BSPRule; import org.apache.wss4j.common.ext.WSSecurityException; import org.apache.wss4j.policy.stax.enforcer.PolicyEnforcer; @@ -145,7 +145,7 @@ public void testIncludeTimestampPolicy() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -248,7 +248,7 @@ public void testIncludeTimestampPolicyNegativeTest() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -370,7 +370,7 @@ public void testIncludeTimestampAndSignedUsernameSupportingTokenPolicy() throws Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -485,7 +485,7 @@ public void testIncludeTimestampAndSignedUsernameSupportingTokenPolicyNegativeTe Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -586,7 +586,7 @@ public void testIncludeTimestampAndSignedUsernameSupportingTokenPolicyNegativeTe Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -708,7 +708,7 @@ public void testIncludeTimestampAndSignedEncryptedUsernameSupportingTokenPolicy( Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -816,7 +816,7 @@ public void testIncludeTimestampAndProtectionOrderEncryptBeforeSignAndSignedUser Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -948,7 +948,7 @@ public void testHttpsClientAuthenticationIncludeTimestampAndSignedUsernameSuppor Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1069,7 +1069,7 @@ public void testHttpsClientAuthenticationPolicyNegative() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1187,7 +1187,7 @@ public void testSignatureAlgorithmSuiteNegative() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1307,7 +1307,7 @@ public void testC14NAlgorithmSuiteNegative() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1424,7 +1424,7 @@ public void testEncryptionAlgorithmSuiteNegative() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override diff --git a/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/DocumentCreatorImpl.java b/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/DocumentCreatorImpl.java index bc7ec5890..19e62f072 100644 --- a/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/DocumentCreatorImpl.java +++ b/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/DocumentCreatorImpl.java @@ -18,12 +18,13 @@ */ package org.apache.wss4j.stax.ext; -import javax.xml.XMLConstants; import javax.xml.parsers.DocumentBuilderFactory; import javax.xml.parsers.ParserConfigurationException; import org.w3c.dom.Document; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; + /** * A default (inefficient) implementation of DocumentCreator which creates a new DocumentBuilderFactory * implementation per-instance of this class. CXF instead uses a lambda to call the CXF DomUtils class @@ -34,10 +35,7 @@ public class DocumentCreatorImpl implements DocumentCreator { private final DocumentBuilderFactory documentBuilderFactory; public DocumentCreatorImpl() throws ParserConfigurationException { - documentBuilderFactory = DocumentBuilderFactory.newInstance(); - documentBuilderFactory.setNamespaceAware(true); - documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); - documentBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); + documentBuilderFactory = SecureDocumentBuilderFactory.newNSInstance(); } public Document newDocument() throws ParserConfigurationException { diff --git a/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/InboundWSSec.java b/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/InboundWSSec.java index bdb86ebaf..f05f6e5ef 100644 --- a/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/InboundWSSec.java +++ b/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/InboundWSSec.java @@ -28,6 +28,7 @@ import javax.xml.stream.XMLStreamException; import javax.xml.stream.XMLStreamReader; +import org.apache.commons.xml.secure.SecureXMLInputFactory; import org.apache.wss4j.common.ext.WSSecurityException; import org.apache.wss4j.stax.ext.DocumentCreatorImpl; import org.apache.wss4j.stax.ext.WSSConstants; @@ -60,7 +61,7 @@ public class InboundWSSec { protected static final transient org.slf4j.Logger LOG = org.slf4j.LoggerFactory.getLogger(InboundWSSec.class); - private static final XMLInputFactory XML_INPUT_FACTORY = XMLInputFactory.newInstance(); + private static final XMLInputFactory XML_INPUT_FACTORY = SecureXMLInputFactory.newInstance(); static { XML_INPUT_FACTORY.setProperty(XMLInputFactory.SUPPORT_DTD, false); diff --git a/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/WSSec.java b/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/WSSec.java index d713956f6..3a44f0720 100644 --- a/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/WSSec.java +++ b/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/WSSec.java @@ -31,6 +31,7 @@ import javax.xml.validation.Schema; import javax.xml.validation.SchemaFactory; +import org.apache.commons.xml.secure.SecureSchemaFactory; import org.apache.wss4j.common.WSS4JConstants; import org.apache.wss4j.common.crypto.WSProviderConfig; import org.apache.wss4j.common.ext.WSSecurityException; @@ -461,8 +462,7 @@ public static WSSSecurityProperties validateAndApplyDefaultsToInboundSecurityPro } public static Schema loadWSSecuritySchemas() throws SAXException { - SchemaFactory schemaFactory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); - schemaFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE); + SchemaFactory schemaFactory = SecureSchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); schemaFactory.setResourceResolver(new LSResourceResolver() { @Override public LSInput resolveResource(String type, String namespaceURI, String publicId, String systemId, String baseURI) { diff --git a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AbstractTestBase.java b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AbstractTestBase.java index 48f5b875d..955f1df8f 100644 --- a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AbstractTestBase.java +++ b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AbstractTestBase.java @@ -48,6 +48,10 @@ import javax.xml.xpath.XPathExpressionException; import javax.xml.xpath.XPathFactory; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; +import org.apache.commons.xml.secure.SecureTransformerFactory; +import org.apache.commons.xml.secure.SecureXMLInputFactory; +import org.apache.commons.xml.secure.SecureXPathFactory; import org.apache.wss4j.common.bsp.BSPRule; import org.apache.wss4j.common.crypto.Crypto; import org.apache.wss4j.common.crypto.CryptoFactory; @@ -90,8 +94,8 @@ public abstract class AbstractTestBase { //javax.xml.transform.Transformer transformer = TransformerFactory.newInstance().newTransformer(); //transformer.transform(new StreamSource(new ByteArrayInputStream(baos.toByteArray())), new StreamResult(System.out)); - protected static final XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance(); - protected static final TransformerFactory TRANSFORMER_FACTORY = TransformerFactory.newInstance(); + protected static final XMLInputFactory xmlInputFactory = SecureXMLInputFactory.newInstance(); + protected static final TransformerFactory TRANSFORMER_FACTORY = SecureTransformerFactory.newInstance(); protected DocumentBuilderFactory documentBuilderFactory; protected static final String SECURED_DOCUMENT = "securedDocument"; @@ -103,13 +107,11 @@ public abstract class AbstractTestBase { } public AbstractTestBase() { - documentBuilderFactory = DocumentBuilderFactory.newInstance(); - documentBuilderFactory.setNamespaceAware(true); + documentBuilderFactory = SecureDocumentBuilderFactory.newNSInstance(); documentBuilderFactory.setIgnoringComments(false); documentBuilderFactory.setCoalescing(false); documentBuilderFactory.setIgnoringElementContentWhitespace(false); xmlInputFactory.setProperty(XMLInputFactory.IS_COALESCING, false); - xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false); //xmlInputFactory.setProperty(WstxInputProperties.P_MIN_TEXT_SEGMENT, new Integer(5 * 8192)); } @@ -311,7 +313,7 @@ private Map getMessageContext(Document document) { } protected XPathExpression getXPath(String expression) throws XPathExpressionException { - XPathFactory xPathFactory = XPathFactory.newInstance(); + XPathFactory xPathFactory = SecureXPathFactory.newInstance(); XPath xPath = xPathFactory.newXPath(); xPath.setNamespaceContext( new NamespaceContext() { diff --git a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/EncDecryptionTest.java b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/EncDecryptionTest.java index 94148b59c..abbc8a021 100644 --- a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/EncDecryptionTest.java +++ b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/EncDecryptionTest.java @@ -48,6 +48,7 @@ import org.apache.commons.compress.compressors.gzip.GzipCompressorInputStream; import org.apache.commons.compress.compressors.gzip.GzipCompressorOutputStream; +import org.apache.commons.xml.secure.SecureTransformerFactory; import org.apache.wss4j.common.ConfigurationConstants; import org.apache.wss4j.common.WSEncryptionPart; import org.apache.wss4j.common.bsp.BSPRule; @@ -1634,7 +1635,7 @@ public void testDecryptionReferenceListOutsideEncryptedKey() throws Exception { assertEquals(nodeList.getLength(), 1); //move ReferenceList... - TransformerFactory transFact = TransformerFactory.newInstance(); + TransformerFactory transFact = SecureTransformerFactory.newInstance(); Transformer trans = transFact.newTransformer(new StreamSource(this.getClass().getClassLoader().getResourceAsStream("xsl/testDecryptionReferenceListOutsideEncryptedKey.xsl"))); baos.reset(); trans.transform(new DOMSource(document), new StreamResult(baos)); diff --git a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/FaultTest.java b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/FaultTest.java index 56a90b043..a5d444fd8 100644 --- a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/FaultTest.java +++ b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/FaultTest.java @@ -29,6 +29,7 @@ import javax.xml.transform.dom.DOMSource; import javax.xml.transform.stream.StreamResult; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.dom.handler.WSHandlerConstants; import org.apache.wss4j.stax.ext.WSSConstants; import org.apache.wss4j.stax.ext.WSSSecurityProperties; @@ -102,8 +103,7 @@ public void testUnsecuredFaultInbound() throws Exception { ByteArrayOutputStream baos = new ByteArrayOutputStream(); { InputStream sourceDocument = this.getClass().getClassLoader().getResourceAsStream("testdata/soap-fault.xml"); - DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); - factory.setNamespaceAware(true); + DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newNSInstance(); DocumentBuilder builder = factory.newDocumentBuilder(); Document securedDocument = builder.parse(sourceDocument); diff --git a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLCallbackHandlerImpl.java b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLCallbackHandlerImpl.java index 8084c0115..d00b41e2b 100644 --- a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLCallbackHandlerImpl.java +++ b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLCallbackHandlerImpl.java @@ -34,6 +34,7 @@ import javax.xml.parsers.DocumentBuilder; import javax.xml.parsers.DocumentBuilderFactory; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.crypto.Merlin; import org.apache.wss4j.common.saml.SAMLCallback; import org.apache.wss4j.common.saml.bean.ActionBean; @@ -202,8 +203,7 @@ protected KeyInfoBean createKeyInfo() throws Exception { } else if (statement == Statement.ATTR) { // Build a new Document DocumentBuilderFactory docBuilderFactory = - DocumentBuilderFactory.newInstance(); - docBuilderFactory.setNamespaceAware(true); + SecureDocumentBuilderFactory.newNSInstance(); DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder(); Document doc = docBuilder.newDocument();