From a72c3cca5b4288cf57ed25bfe8bb9dfbafe03df0 Mon Sep 17 00:00:00 2001 From: Gary Gregory Date: Sun, 6 Sep 2026 12:01:45 -0400 Subject: [PATCH 1/6] Harden XML parsing via commons-secure-xml This reuses Apache Commons Secure XML. --- integration/pom.xml | 4 ++ .../test/kerberos/KerberosTest.java | 9 ++-- parent/pom.xml | 5 ++ ws-security-common/pom.xml | 4 ++ .../apache/wss4j/common/util/XMLUtils.java | 5 +- .../apache/wss4j/common/util/SOAPUtil.java | 5 +- .../common/AbstractSAMLCallbackHandler.java | 3 +- .../common/SAMLElementCallbackHandler.java | 3 +- .../components/crypto/CryptoProviderTest.java | 5 +- .../wss4j/dom/handler/CustomTokenTest.java | 3 +- .../dom/message/SignaturePrefixListTest.java | 3 +- .../wss4j/dom/message/SignatureTest.java | 3 +- .../message/token/DerivedKeyTokenTest.java | 3 +- .../dom/message/token/ReferenceTest.java | 3 +- .../apache/wss4j/dom/saml/SamlTokenTest.java | 5 +- .../dom/saml/SignedSamlTokenHOKTest.java | 3 +- .../dom/saml/ext/AssertionSigningTest.java | 3 +- .../stax/test/AbstractPolicyTestBase.java | 3 +- .../AsymmetricBindingIntegrationTest.java | 48 +++++++++---------- .../test/TransportBindingIntegrationTest.java | 26 +++++----- .../wss4j/stax/ext/DocumentCreatorImpl.java | 4 +- .../apache/wss4j/stax/setup/InboundWSSec.java | 3 +- .../org/apache/wss4j/stax/setup/WSSec.java | 3 +- .../wss4j/stax/test/AbstractTestBase.java | 12 +++-- .../wss4j/stax/test/EncDecryptionTest.java | 3 +- .../org/apache/wss4j/stax/test/FaultTest.java | 3 +- .../test/saml/SAMLCallbackHandlerImpl.java | 3 +- 27 files changed, 111 insertions(+), 66 deletions(-) diff --git a/integration/pom.xml b/integration/pom.xml index daee20400..495f23c32 100644 --- a/integration/pom.xml +++ b/integration/pom.xml @@ -45,6 +45,10 @@ + + org.apache.commons + commons-secure-xml + org.apache.wss4j wss4j-ws-security-common diff --git a/integration/src/test/java/org/apache/wss4j/integration/test/kerberos/KerberosTest.java b/integration/src/test/java/org/apache/wss4j/integration/test/kerberos/KerberosTest.java index 228db1f52..d39eb8297 100644 --- a/integration/src/test/java/org/apache/wss4j/integration/test/kerberos/KerberosTest.java +++ b/integration/src/test/java/org/apache/wss4j/integration/test/kerberos/KerberosTest.java @@ -42,6 +42,9 @@ import javax.xml.transform.dom.DOMSource; import javax.xml.transform.stream.StreamResult; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; +import org.apache.commons.xml.secure.SecureTransformerFactory; +import org.apache.commons.xml.secure.SecureXMLInputFactory; import org.apache.kerby.kerberos.kerb.server.SimpleKdcServer; import org.apache.wss4j.common.ext.WSSecurityException; import org.apache.wss4j.common.kerberos.KerberosContextAndServiceNameCallback; @@ -90,8 +93,8 @@ public class KerberosTest { private static final org.slf4j.Logger LOG = org.slf4j.LoggerFactory.getLogger(KerberosTest.class); - private static final XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance(); - private static final TransformerFactory TRANSFORMER_FACTORY = TransformerFactory.newInstance(); + private static final XMLInputFactory xmlInputFactory = SecureXMLInputFactory.newInstance(); + private static final TransformerFactory TRANSFORMER_FACTORY = SecureTransformerFactory.newInstance(); private static DocumentBuilderFactory dbf; private static boolean runTests = true; @@ -135,7 +138,7 @@ public static void setUp() throws Exception { runTests = false; } - dbf = DocumentBuilderFactory.newInstance(); + dbf = SecureDocumentBuilderFactory.newInstance(); dbf.setNamespaceAware(true); dbf.setIgnoringComments(false); dbf.setCoalescing(false); diff --git a/parent/pom.xml b/parent/pom.xml index eb3d51e79..484204eb9 100644 --- a/parent/pom.xml +++ b/parent/pom.xml @@ -202,6 +202,11 @@ jakarta.xml.bind-api ${xml.bind.api.version} + + org.apache.commons + commons-secure-xml + 1.0.0 + diff --git a/ws-security-common/pom.xml b/ws-security-common/pom.xml index a30e173b7..ac03c3247 100644 --- a/ws-security-common/pom.xml +++ b/ws-security-common/pom.xml @@ -212,6 +212,10 @@ ${opensaml.version} compile + + org.apache.commons + commons-secure-xml + org.ehcache ehcache diff --git a/ws-security-common/src/main/java/org/apache/wss4j/common/util/XMLUtils.java b/ws-security-common/src/main/java/org/apache/wss4j/common/util/XMLUtils.java index 136b18410..67f1f0076 100644 --- a/ws-security-common/src/main/java/org/apache/wss4j/common/util/XMLUtils.java +++ b/ws-security-common/src/main/java/org/apache/wss4j/common/util/XMLUtils.java @@ -44,8 +44,11 @@ import org.w3c.dom.NamedNodeMap; import org.w3c.dom.Node; import org.w3c.dom.Text; + import org.xml.sax.InputSource; +import org.apache.commons.xml.secure.SecureTransformerFactory; + public final class XMLUtils { public static final String XMLNS_NS = "http://www.w3.org/2000/xmlns/"; @@ -140,7 +143,7 @@ public static void elementToStream(Element element, OutputStream out) DOMSource source = new DOMSource(element); StreamResult result = new StreamResult(out); - TransformerFactory transFactory = TransformerFactory.newInstance(); + TransformerFactory transFactory = SecureTransformerFactory.newInstance(); transFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); try { transFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); diff --git a/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java b/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java index b63cd2c91..92d7aaff1 100644 --- a/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java +++ b/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java @@ -21,7 +21,10 @@ import javax.xml.parsers.DocumentBuilder; import javax.xml.parsers.DocumentBuilderFactory; + import jakarta.xml.soap.MessageFactory; + +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import java.io.ByteArrayInputStream; import java.io.InputStream; @@ -41,7 +44,7 @@ public class SOAPUtil { private static final org.slf4j.Logger LOG = org.slf4j.LoggerFactory.getLogger(SOAPUtil.class); - private static DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); + private static DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); private static MessageFactory saajFactory = null; static { diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/AbstractSAMLCallbackHandler.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/AbstractSAMLCallbackHandler.java index 3bdd0bc2a..8c55c011b 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/AbstractSAMLCallbackHandler.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/AbstractSAMLCallbackHandler.java @@ -20,6 +20,7 @@ package org.apache.wss4j.dom.common; import org.apache.wss4j.dom.WSConstants; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.crypto.Crypto; import org.apache.wss4j.common.saml.SAMLCallback; import org.apache.wss4j.common.saml.bean.ActionBean; @@ -235,7 +236,7 @@ protected KeyInfoBean createKeyInfo() throws Exception { } else if (statement == Statement.ATTR) { // Build a new Document DocumentBuilderFactory docBuilderFactory = - DocumentBuilderFactory.newInstance(); + SecureDocumentBuilderFactory.newInstance(); docBuilderFactory.setNamespaceAware(true); DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder(); Document doc = docBuilder.newDocument(); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/SAMLElementCallbackHandler.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/SAMLElementCallbackHandler.java index 3ff1e92a2..0d13fa7de 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/SAMLElementCallbackHandler.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/SAMLElementCallbackHandler.java @@ -26,6 +26,7 @@ import javax.xml.parsers.DocumentBuilderFactory; import org.apache.wss4j.common.saml.SamlAssertionWrapper; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.saml.SAMLCallback; import org.apache.wss4j.common.saml.SAMLUtil; import org.apache.wss4j.common.saml.builder.SAML1Constants; @@ -75,7 +76,7 @@ private Element getSAMLAssertion() throws Exception { SamlAssertionWrapper samlAssertionWrapper = new SamlAssertionWrapper(samlCallback); - DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); + DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); return samlAssertionWrapper.toDOM(factory.newDocumentBuilder().newDocument()); } diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java index f95a29509..cbb5dc96f 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java @@ -24,6 +24,7 @@ import org.apache.wss4j.dom.common.KeystoreCallbackHandler; import org.apache.wss4j.dom.engine.WSSecurityEngine; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.crypto.Crypto; import org.apache.wss4j.common.crypto.CryptoFactory; import org.apache.wss4j.common.ext.WSSecurityException; @@ -120,7 +121,7 @@ public void testSignatureEmailAddress() throws Exception { outputString.replace("1.2.840.113549.1.9.1=#16125765726e6572406578616d706c652e636f6d", "EMAILADDRESS=Werner@example.com"); - DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); + DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newInstance(); dbf.setNamespaceAware(true); InputStream is = new ByteArrayInputStream(outputString.getBytes()); Document parsedDoc = dbf.newDocumentBuilder().parse(is); @@ -148,7 +149,7 @@ public void testSignatureOtherEmailAddress() throws Exception { outputString.replace("1.2.840.113549.1.9.1=#16125765726e6572406578616d706c652e636f6d", "E=Werner@example.com"); - DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); + DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newInstance(); dbf.setNamespaceAware(true); InputStream is = new ByteArrayInputStream(outputString.getBytes()); Document parsedDoc = dbf.newDocumentBuilder().parse(is); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/handler/CustomTokenTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/handler/CustomTokenTest.java index 03495186e..93c23be32 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/handler/CustomTokenTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/handler/CustomTokenTest.java @@ -28,6 +28,7 @@ import javax.security.auth.callback.UnsupportedCallbackException; import javax.xml.parsers.DocumentBuilderFactory; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.ext.WSPasswordCallback; import org.apache.wss4j.common.util.SOAPUtil; import org.apache.wss4j.common.util.XMLUtils; @@ -58,7 +59,7 @@ public class CustomTokenTest { @Test public void testCustomTokenTimestamp() throws Exception { // Create a Timestamp manually - DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); + DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newInstance(); dbf.setNamespaceAware(true); Document timestampDoc = dbf.newDocumentBuilder().newDocument(); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePrefixListTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePrefixListTest.java index 63521643e..6fe92d166 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePrefixListTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePrefixListTest.java @@ -32,6 +32,7 @@ import javax.xml.parsers.DocumentBuilder; import javax.xml.parsers.DocumentBuilderFactory; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.crypto.Crypto; import org.apache.wss4j.common.crypto.CryptoFactory; import org.apache.wss4j.common.crypto.CryptoType; @@ -72,7 +73,7 @@ public void testDuplicatePrefixListValues() throws Exception { Document doc = null; try (InputStream inputStream = Loader.getResource("org/apache/wss4j/dom/message/SignaturePrefixListMessage.xml").openStream()) { - DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); + DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); factory.setNamespaceAware(true); DocumentBuilder builder = factory.newDocumentBuilder(); doc = builder.parse(inputStream); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignatureTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignatureTest.java index 06bb4e9f9..c1e3a2720 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignatureTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignatureTest.java @@ -35,6 +35,7 @@ import javax.xml.parsers.DocumentBuilder; import javax.xml.parsers.DocumentBuilderFactory; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.WSEncryptionPart; import org.apache.wss4j.common.bsp.BSPRule; import org.apache.wss4j.common.crypto.Crypto; @@ -1032,7 +1033,7 @@ public void testCustomKeyInfoElementCreation() throws Exception { // Create the KeyInfo DocumentBuilderFactory docBuilderFactory = - DocumentBuilderFactory.newInstance(); + SecureDocumentBuilderFactory.newInstance(); docBuilderFactory.setNamespaceAware(true); DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder(); Document keyInfoDoc = docBuilder.newDocument(); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/DerivedKeyTokenTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/DerivedKeyTokenTest.java index 723997990..59e157034 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/DerivedKeyTokenTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/DerivedKeyTokenTest.java @@ -19,6 +19,7 @@ package org.apache.wss4j.dom.message.token; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.bsp.BSPEnforcer; @@ -93,7 +94,7 @@ private static org.w3c.dom.Document createReferenceDocument( final java.io.InputStream in = new java.io.ByteArrayInputStream( template.replaceFirst("PLACEHOLDER1", placeholder1) .replaceFirst("PLACEHOLDER2", placeholder2).getBytes()); - final javax.xml.parsers.DocumentBuilderFactory factory = javax.xml.parsers.DocumentBuilderFactory + final javax.xml.parsers.DocumentBuilderFactory factory = SecureDocumentBuilderFactory .newInstance(); factory.setNamespaceAware(true); final javax.xml.parsers.DocumentBuilder builder = factory diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/ReferenceTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/ReferenceTest.java index 508aa05c7..fff032af0 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/ReferenceTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/ReferenceTest.java @@ -19,6 +19,7 @@ package org.apache.wss4j.dom.message.token; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.ext.WSSecurityException; import org.apache.wss4j.common.token.Reference; @@ -155,7 +156,7 @@ public void testHashcode() throws Exception{ ).getBytes() ); final javax.xml.parsers.DocumentBuilderFactory factory = - javax.xml.parsers.DocumentBuilderFactory.newInstance(); + SecureDocumentBuilderFactory.newInstance(); factory.setNamespaceAware(true); final javax.xml.parsers.DocumentBuilder builder = factory.newDocumentBuilder(); return builder.parse(in); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenTest.java index 39c77cb50..81d06260b 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenTest.java @@ -35,6 +35,7 @@ import javax.security.auth.callback.CallbackHandler; import javax.xml.parsers.DocumentBuilderFactory; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.bsp.BSPRule; import org.apache.wss4j.common.crypto.Crypto; import org.apache.wss4j.common.crypto.CryptoFactory; @@ -1029,7 +1030,7 @@ public void testAssertionWrapper() throws Exception { SAMLUtil.doSAMLCallback(callbackHandler, samlCallback); SamlAssertionWrapper samlAssertion = new SamlAssertionWrapper(samlCallback); - DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); + DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newInstance(); dbf.setNamespaceAware(true); Document doc = dbf.newDocumentBuilder().newDocument(); String assertionString = DOM2Writer.nodeToString(samlAssertion.toDOM(doc)); @@ -1059,7 +1060,7 @@ public void testAssertionWrapperNoDocument() throws Exception { // Convert String to DOM + into an assertionWrapper InputStream in = new ByteArrayInputStream(assertionString.getBytes()); - DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); + DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newInstance(); dbf.setNamespaceAware(true); Document newDoc = dbf.newDocumentBuilder().parse(in); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SignedSamlTokenHOKTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SignedSamlTokenHOKTest.java index f556528d1..e6360209e 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SignedSamlTokenHOKTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SignedSamlTokenHOKTest.java @@ -32,6 +32,7 @@ import org.apache.wss4j.dom.engine.WSSecurityEngineResult; import org.apache.wss4j.dom.handler.RequestData; import org.apache.wss4j.dom.handler.WSHandlerResult; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.bsp.BSPRule; import org.apache.wss4j.common.crypto.Crypto; import org.apache.wss4j.common.crypto.CryptoFactory; @@ -710,7 +711,7 @@ public void testX509DataAndKeyValue() throws Exception { // Create the KeyInfo DocumentBuilderFactory docBuilderFactory = - DocumentBuilderFactory.newInstance(); + SecureDocumentBuilderFactory.newInstance(); docBuilderFactory.setNamespaceAware(true); DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder(); Document keyInfoDoc = docBuilder.newDocument(); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/ext/AssertionSigningTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/ext/AssertionSigningTest.java index 15d4d7e63..af7263ced 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/ext/AssertionSigningTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/ext/AssertionSigningTest.java @@ -24,6 +24,7 @@ import javax.xml.parsers.DocumentBuilderFactory; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.crypto.Crypto; import org.apache.wss4j.common.crypto.CryptoType; import org.apache.wss4j.common.crypto.Merlin; @@ -81,7 +82,7 @@ public AssertionSigningTest() throws Exception { input.close(); ((Merlin) issuerCrypto).setKeyStore(keyStore); - dbf = DocumentBuilderFactory.newInstance(); + dbf = SecureDocumentBuilderFactory.newInstance(); dbf.setNamespaceAware(true); } diff --git a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java index cfd834959..5ed173115 100644 --- a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java +++ b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java @@ -18,6 +18,7 @@ */ package org.apache.wss4j.policy.stax.test; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.neethi.builders.AssertionBuilder; import org.apache.wss4j.common.crypto.WSProviderConfig; import org.apache.wss4j.common.ext.WSSecurityException; @@ -82,7 +83,7 @@ protected PolicyEnforcer buildAndStartPolicyEngine(String policyString, boolean protected PolicyEnforcer buildAndStartPolicyEngine( String policyString, boolean replacePolicyElement, List> customAssertionBuilders) throws ParserConfigurationException, SAXException, IOException, WSSPolicyException { - DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance(); + DocumentBuilderFactory documentBuilderFactory = SecureDocumentBuilderFactory.newInstance(); documentBuilderFactory.setNamespaceAware(true); documentBuilderFactory.setValidating(false); DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder(); diff --git a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AsymmetricBindingIntegrationTest.java b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AsymmetricBindingIntegrationTest.java index 7a4711a8c..421a06974 100644 --- a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AsymmetricBindingIntegrationTest.java +++ b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AsymmetricBindingIntegrationTest.java @@ -30,10 +30,10 @@ import javax.xml.namespace.QName; import javax.xml.stream.XMLStreamException; import javax.xml.transform.Transformer; -import javax.xml.transform.TransformerFactory; import javax.xml.transform.dom.DOMSource; import javax.xml.transform.stream.StreamResult; +import org.apache.commons.xml.secure.SecureTransformerFactory; import org.apache.wss4j.common.bsp.BSPRule; import org.apache.wss4j.common.crypto.CryptoType; import org.apache.wss4j.common.crypto.Merlin; @@ -154,7 +154,7 @@ public void testIncludeTimestampPolicy() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -297,7 +297,7 @@ public void testIncludeTimestampPolicy2ndAlternative() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -404,7 +404,7 @@ public void testIncludeTimestampPolicyNegativeTest() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -532,7 +532,7 @@ public void testIncludeTimestampAndSignedUsernameSupportingTokenPolicy() throws Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -654,7 +654,7 @@ public void testIncludeTimestampAndSignedUsernameSupportingTokenPolicyNegativeTe Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -783,7 +783,7 @@ public void testIncludeTimestampAndSignedUsernameSupportingTokenPolicyNegativeTe Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -904,7 +904,7 @@ public void testIncludeTimestampAndProtectionOrderEncryptBeforeSignAndSignedUser Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1016,7 +1016,7 @@ public void testSignatureAlgorithmSuiteNegative() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1136,7 +1136,7 @@ public void testC14NAlgorithmSuiteNegative() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1253,7 +1253,7 @@ public void testEncryptionAlgorithmSuiteNegative() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1369,7 +1369,7 @@ public void testPolicyReenabledRSA15KeyTransportAlgorithm() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1478,7 +1478,7 @@ public void testSignatureProtectionPolicy() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1587,7 +1587,7 @@ public void testSignatureProtectionPolicyNegative1() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1701,7 +1701,7 @@ public void testSignatureProtectionPolicyNegative2() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1829,7 +1829,7 @@ public void testEntireHeaderAndBodySignature() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1930,7 +1930,7 @@ public void testEntireHeaderAndBodySignatureNegative() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -2039,7 +2039,7 @@ public void testEntireHeaderAndBodySignatureNegative2() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -2301,7 +2301,7 @@ public void testTokenScenario() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -2429,7 +2429,7 @@ public void testTokenScenarioLateEncryption() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -2537,7 +2537,7 @@ public void testRecipientTokenInclusionAlwaysToRecipientPolicy() throws Exceptio Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -2651,7 +2651,7 @@ public void testInitiatorTokenInclusionAlwaysToRecipientPolicy() throws Exceptio Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -2764,7 +2764,7 @@ public void testSignBeforeEncryptNegativeTest() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -2878,7 +2878,7 @@ public void testEncryptBeforeSigningNegativeTest() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override diff --git a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/TransportBindingIntegrationTest.java b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/TransportBindingIntegrationTest.java index 2d83be4ad..e8d629b40 100644 --- a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/TransportBindingIntegrationTest.java +++ b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/TransportBindingIntegrationTest.java @@ -29,10 +29,10 @@ import javax.xml.namespace.QName; import javax.xml.stream.XMLStreamException; import javax.xml.transform.Transformer; -import javax.xml.transform.TransformerFactory; import javax.xml.transform.dom.DOMSource; import javax.xml.transform.stream.StreamResult; +import org.apache.commons.xml.secure.SecureTransformerFactory; import org.apache.wss4j.common.bsp.BSPRule; import org.apache.wss4j.common.ext.WSSecurityException; import org.apache.wss4j.policy.stax.enforcer.PolicyEnforcer; @@ -145,7 +145,7 @@ public void testIncludeTimestampPolicy() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -248,7 +248,7 @@ public void testIncludeTimestampPolicyNegativeTest() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -370,7 +370,7 @@ public void testIncludeTimestampAndSignedUsernameSupportingTokenPolicy() throws Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -485,7 +485,7 @@ public void testIncludeTimestampAndSignedUsernameSupportingTokenPolicyNegativeTe Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -586,7 +586,7 @@ public void testIncludeTimestampAndSignedUsernameSupportingTokenPolicyNegativeTe Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -708,7 +708,7 @@ public void testIncludeTimestampAndSignedEncryptedUsernameSupportingTokenPolicy( Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -816,7 +816,7 @@ public void testIncludeTimestampAndProtectionOrderEncryptBeforeSignAndSignedUser Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -948,7 +948,7 @@ public void testHttpsClientAuthenticationIncludeTimestampAndSignedUsernameSuppor Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1069,7 +1069,7 @@ public void testHttpsClientAuthenticationPolicyNegative() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1187,7 +1187,7 @@ public void testSignatureAlgorithmSuiteNegative() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1307,7 +1307,7 @@ public void testC14NAlgorithmSuiteNegative() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override @@ -1424,7 +1424,7 @@ public void testEncryptionAlgorithmSuiteNegative() throws Exception { Document document = doInboundSecurity(inSecurityProperties, new ByteArrayInputStream(baos.toByteArray()), securityEventList, policyEnforcer); //read the whole stream: - Transformer transformer = TransformerFactory.newInstance().newTransformer(); + Transformer transformer = SecureTransformerFactory.newInstance().newTransformer(); transformer.transform(new DOMSource(document), new StreamResult( new OutputStream() { @Override diff --git a/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/DocumentCreatorImpl.java b/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/DocumentCreatorImpl.java index bc7ec5890..7f858f1e4 100644 --- a/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/DocumentCreatorImpl.java +++ b/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/DocumentCreatorImpl.java @@ -24,6 +24,8 @@ import org.w3c.dom.Document; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; + /** * A default (inefficient) implementation of DocumentCreator which creates a new DocumentBuilderFactory * implementation per-instance of this class. CXF instead uses a lambda to call the CXF DomUtils class @@ -34,7 +36,7 @@ public class DocumentCreatorImpl implements DocumentCreator { private final DocumentBuilderFactory documentBuilderFactory; public DocumentCreatorImpl() throws ParserConfigurationException { - documentBuilderFactory = DocumentBuilderFactory.newInstance(); + documentBuilderFactory = SecureDocumentBuilderFactory.newInstance(); documentBuilderFactory.setNamespaceAware(true); documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); documentBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); diff --git a/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/InboundWSSec.java b/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/InboundWSSec.java index bdb86ebaf..f05f6e5ef 100644 --- a/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/InboundWSSec.java +++ b/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/InboundWSSec.java @@ -28,6 +28,7 @@ import javax.xml.stream.XMLStreamException; import javax.xml.stream.XMLStreamReader; +import org.apache.commons.xml.secure.SecureXMLInputFactory; import org.apache.wss4j.common.ext.WSSecurityException; import org.apache.wss4j.stax.ext.DocumentCreatorImpl; import org.apache.wss4j.stax.ext.WSSConstants; @@ -60,7 +61,7 @@ public class InboundWSSec { protected static final transient org.slf4j.Logger LOG = org.slf4j.LoggerFactory.getLogger(InboundWSSec.class); - private static final XMLInputFactory XML_INPUT_FACTORY = XMLInputFactory.newInstance(); + private static final XMLInputFactory XML_INPUT_FACTORY = SecureXMLInputFactory.newInstance(); static { XML_INPUT_FACTORY.setProperty(XMLInputFactory.SUPPORT_DTD, false); diff --git a/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/WSSec.java b/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/WSSec.java index d713956f6..dbf54a0a5 100644 --- a/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/WSSec.java +++ b/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/WSSec.java @@ -31,6 +31,7 @@ import javax.xml.validation.Schema; import javax.xml.validation.SchemaFactory; +import org.apache.commons.xml.secure.SecureSchemaFactory; import org.apache.wss4j.common.WSS4JConstants; import org.apache.wss4j.common.crypto.WSProviderConfig; import org.apache.wss4j.common.ext.WSSecurityException; @@ -461,7 +462,7 @@ public static WSSSecurityProperties validateAndApplyDefaultsToInboundSecurityPro } public static Schema loadWSSecuritySchemas() throws SAXException { - SchemaFactory schemaFactory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); + SchemaFactory schemaFactory = SecureSchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); schemaFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE); schemaFactory.setResourceResolver(new LSResourceResolver() { @Override diff --git a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AbstractTestBase.java b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AbstractTestBase.java index 48f5b875d..432dd953a 100644 --- a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AbstractTestBase.java +++ b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AbstractTestBase.java @@ -48,6 +48,10 @@ import javax.xml.xpath.XPathExpressionException; import javax.xml.xpath.XPathFactory; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; +import org.apache.commons.xml.secure.SecureTransformerFactory; +import org.apache.commons.xml.secure.SecureXMLInputFactory; +import org.apache.commons.xml.secure.SecureXPathFactory; import org.apache.wss4j.common.bsp.BSPRule; import org.apache.wss4j.common.crypto.Crypto; import org.apache.wss4j.common.crypto.CryptoFactory; @@ -90,8 +94,8 @@ public abstract class AbstractTestBase { //javax.xml.transform.Transformer transformer = TransformerFactory.newInstance().newTransformer(); //transformer.transform(new StreamSource(new ByteArrayInputStream(baos.toByteArray())), new StreamResult(System.out)); - protected static final XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance(); - protected static final TransformerFactory TRANSFORMER_FACTORY = TransformerFactory.newInstance(); + protected static final XMLInputFactory xmlInputFactory = SecureXMLInputFactory.newInstance(); + protected static final TransformerFactory TRANSFORMER_FACTORY = SecureTransformerFactory.newInstance(); protected DocumentBuilderFactory documentBuilderFactory; protected static final String SECURED_DOCUMENT = "securedDocument"; @@ -103,7 +107,7 @@ public abstract class AbstractTestBase { } public AbstractTestBase() { - documentBuilderFactory = DocumentBuilderFactory.newInstance(); + documentBuilderFactory = SecureDocumentBuilderFactory.newInstance(); documentBuilderFactory.setNamespaceAware(true); documentBuilderFactory.setIgnoringComments(false); documentBuilderFactory.setCoalescing(false); @@ -311,7 +315,7 @@ private Map getMessageContext(Document document) { } protected XPathExpression getXPath(String expression) throws XPathExpressionException { - XPathFactory xPathFactory = XPathFactory.newInstance(); + XPathFactory xPathFactory = SecureXPathFactory.newInstance(); XPath xPath = xPathFactory.newXPath(); xPath.setNamespaceContext( new NamespaceContext() { diff --git a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/EncDecryptionTest.java b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/EncDecryptionTest.java index 94148b59c..abbc8a021 100644 --- a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/EncDecryptionTest.java +++ b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/EncDecryptionTest.java @@ -48,6 +48,7 @@ import org.apache.commons.compress.compressors.gzip.GzipCompressorInputStream; import org.apache.commons.compress.compressors.gzip.GzipCompressorOutputStream; +import org.apache.commons.xml.secure.SecureTransformerFactory; import org.apache.wss4j.common.ConfigurationConstants; import org.apache.wss4j.common.WSEncryptionPart; import org.apache.wss4j.common.bsp.BSPRule; @@ -1634,7 +1635,7 @@ public void testDecryptionReferenceListOutsideEncryptedKey() throws Exception { assertEquals(nodeList.getLength(), 1); //move ReferenceList... - TransformerFactory transFact = TransformerFactory.newInstance(); + TransformerFactory transFact = SecureTransformerFactory.newInstance(); Transformer trans = transFact.newTransformer(new StreamSource(this.getClass().getClassLoader().getResourceAsStream("xsl/testDecryptionReferenceListOutsideEncryptedKey.xsl"))); baos.reset(); trans.transform(new DOMSource(document), new StreamResult(baos)); diff --git a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/FaultTest.java b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/FaultTest.java index 56a90b043..411cb71a4 100644 --- a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/FaultTest.java +++ b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/FaultTest.java @@ -29,6 +29,7 @@ import javax.xml.transform.dom.DOMSource; import javax.xml.transform.stream.StreamResult; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.dom.handler.WSHandlerConstants; import org.apache.wss4j.stax.ext.WSSConstants; import org.apache.wss4j.stax.ext.WSSSecurityProperties; @@ -102,7 +103,7 @@ public void testUnsecuredFaultInbound() throws Exception { ByteArrayOutputStream baos = new ByteArrayOutputStream(); { InputStream sourceDocument = this.getClass().getClassLoader().getResourceAsStream("testdata/soap-fault.xml"); - DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); + DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); factory.setNamespaceAware(true); DocumentBuilder builder = factory.newDocumentBuilder(); Document securedDocument = builder.parse(sourceDocument); diff --git a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLCallbackHandlerImpl.java b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLCallbackHandlerImpl.java index 8084c0115..4d69651db 100644 --- a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLCallbackHandlerImpl.java +++ b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLCallbackHandlerImpl.java @@ -34,6 +34,7 @@ import javax.xml.parsers.DocumentBuilder; import javax.xml.parsers.DocumentBuilderFactory; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.apache.wss4j.common.crypto.Merlin; import org.apache.wss4j.common.saml.SAMLCallback; import org.apache.wss4j.common.saml.bean.ActionBean; @@ -202,7 +203,7 @@ protected KeyInfoBean createKeyInfo() throws Exception { } else if (statement == Statement.ATTR) { // Build a new Document DocumentBuilderFactory docBuilderFactory = - DocumentBuilderFactory.newInstance(); + SecureDocumentBuilderFactory.newInstance(); docBuilderFactory.setNamespaceAware(true); DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder(); Document doc = docBuilder.newDocument(); From 29b266030b14a875a5a9b448396b60a7537bc13f Mon Sep 17 00:00:00 2001 From: Gary Gregory Date: Mon, 7 Sep 2026 12:21:18 -0400 Subject: [PATCH 2/6] Update integration/src/test/java/org/apache/wss4j/integration/test/kerberos/KerberosTest.java Co-authored-by: Piotr P. Karwasz --- .../apache/wss4j/integration/test/kerberos/KerberosTest.java | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/integration/src/test/java/org/apache/wss4j/integration/test/kerberos/KerberosTest.java b/integration/src/test/java/org/apache/wss4j/integration/test/kerberos/KerberosTest.java index d39eb8297..ac965ae51 100644 --- a/integration/src/test/java/org/apache/wss4j/integration/test/kerberos/KerberosTest.java +++ b/integration/src/test/java/org/apache/wss4j/integration/test/kerberos/KerberosTest.java @@ -138,8 +138,7 @@ public static void setUp() throws Exception { runTests = false; } - dbf = SecureDocumentBuilderFactory.newInstance(); - dbf.setNamespaceAware(true); + dbf = SecureDocumentBuilderFactory.newNSInstance(); dbf.setIgnoringComments(false); dbf.setCoalescing(false); dbf.setIgnoringElementContentWhitespace(false); From 462c23a0cb75f89484dc060249a3875d94c75bf9 Mon Sep 17 00:00:00 2001 From: Gary Gregory Date: Mon, 7 Sep 2026 13:09:10 -0400 Subject: [PATCH 3/6] Harden XML parsing via commons-secure-xml Remove now redundant code. --- .../java/org/apache/wss4j/common/util/XMLUtils.java | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/ws-security-common/src/main/java/org/apache/wss4j/common/util/XMLUtils.java b/ws-security-common/src/main/java/org/apache/wss4j/common/util/XMLUtils.java index 67f1f0076..33e7f5ed1 100644 --- a/ws-security-common/src/main/java/org/apache/wss4j/common/util/XMLUtils.java +++ b/ws-security-common/src/main/java/org/apache/wss4j/common/util/XMLUtils.java @@ -27,7 +27,6 @@ import java.util.Collections; import java.util.List; -import javax.xml.XMLConstants; import javax.xml.transform.Source; import javax.xml.transform.Transformer; import javax.xml.transform.TransformerException; @@ -142,16 +141,7 @@ public static void elementToStream(Element element, OutputStream out) throws TransformerException { DOMSource source = new DOMSource(element); StreamResult result = new StreamResult(out); - TransformerFactory transFactory = SecureTransformerFactory.newInstance(); - transFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); - try { - transFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); - transFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); - } catch (IllegalArgumentException ex) { //NOPMD - // ignore - } - Transformer transformer = transFactory.newTransformer(); transformer.transform(source, result); } From 84a937c746bd9820e6b8315072ddef58b89240c3 Mon Sep 17 00:00:00 2001 From: Gary Gregory Date: Sat, 12 Sep 2026 16:14:28 +0000 Subject: [PATCH 4/6] Use newNSInstance(). --- .../wss4j/dom/common/AbstractSAMLCallbackHandler.java | 3 +-- .../wss4j/dom/components/crypto/CryptoProviderTest.java | 6 ++---- .../java/org/apache/wss4j/dom/handler/CustomTokenTest.java | 3 +-- .../apache/wss4j/dom/message/SignaturePrefixListTest.java | 3 +-- .../java/org/apache/wss4j/dom/message/SignatureTest.java | 3 +-- .../apache/wss4j/dom/message/token/DerivedKeyTokenTest.java | 3 +-- .../org/apache/wss4j/dom/message/token/ReferenceTest.java | 3 +-- .../test/java/org/apache/wss4j/dom/saml/SamlTokenTest.java | 6 ++---- .../org/apache/wss4j/dom/saml/SignedSamlTokenHOKTest.java | 3 +-- .../org/apache/wss4j/dom/saml/ext/AssertionSigningTest.java | 3 +-- .../wss4j/policy/stax/test/AbstractPolicyTestBase.java | 3 +-- .../java/org/apache/wss4j/stax/ext/DocumentCreatorImpl.java | 6 +----- .../java/org/apache/wss4j/stax/test/AbstractTestBase.java | 4 +--- .../src/test/java/org/apache/wss4j/stax/test/FaultTest.java | 3 +-- .../wss4j/stax/test/saml/SAMLCallbackHandlerImpl.java | 3 +-- 15 files changed, 17 insertions(+), 38 deletions(-) diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/AbstractSAMLCallbackHandler.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/AbstractSAMLCallbackHandler.java index 8c55c011b..97ed3935f 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/AbstractSAMLCallbackHandler.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/common/AbstractSAMLCallbackHandler.java @@ -236,8 +236,7 @@ protected KeyInfoBean createKeyInfo() throws Exception { } else if (statement == Statement.ATTR) { // Build a new Document DocumentBuilderFactory docBuilderFactory = - SecureDocumentBuilderFactory.newInstance(); - docBuilderFactory.setNamespaceAware(true); + SecureDocumentBuilderFactory.newNSInstance(); DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder(); Document doc = docBuilder.newDocument(); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java index cbb5dc96f..bff157992 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java @@ -121,8 +121,7 @@ public void testSignatureEmailAddress() throws Exception { outputString.replace("1.2.840.113549.1.9.1=#16125765726e6572406578616d706c652e636f6d", "EMAILADDRESS=Werner@example.com"); - DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newInstance(); - dbf.setNamespaceAware(true); + DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newNSInstance(); InputStream is = new ByteArrayInputStream(outputString.getBytes()); Document parsedDoc = dbf.newDocumentBuilder().parse(is); verify(parsedDoc); @@ -149,8 +148,7 @@ public void testSignatureOtherEmailAddress() throws Exception { outputString.replace("1.2.840.113549.1.9.1=#16125765726e6572406578616d706c652e636f6d", "E=Werner@example.com"); - DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newInstance(); - dbf.setNamespaceAware(true); + DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newNSInstance(); InputStream is = new ByteArrayInputStream(outputString.getBytes()); Document parsedDoc = dbf.newDocumentBuilder().parse(is); verify(parsedDoc); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/handler/CustomTokenTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/handler/CustomTokenTest.java index 93c23be32..05f0bbce6 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/handler/CustomTokenTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/handler/CustomTokenTest.java @@ -59,8 +59,7 @@ public class CustomTokenTest { @Test public void testCustomTokenTimestamp() throws Exception { // Create a Timestamp manually - DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newInstance(); - dbf.setNamespaceAware(true); + DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newNSInstance(); Document timestampDoc = dbf.newDocumentBuilder().newDocument(); WSSecTimestamp timestamp = new WSSecTimestamp(timestampDoc); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePrefixListTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePrefixListTest.java index 6fe92d166..911bc4a67 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePrefixListTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePrefixListTest.java @@ -73,8 +73,7 @@ public void testDuplicatePrefixListValues() throws Exception { Document doc = null; try (InputStream inputStream = Loader.getResource("org/apache/wss4j/dom/message/SignaturePrefixListMessage.xml").openStream()) { - DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); - factory.setNamespaceAware(true); + DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newNSInstance(); DocumentBuilder builder = factory.newDocumentBuilder(); doc = builder.parse(inputStream); } diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignatureTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignatureTest.java index c1e3a2720..128f13db5 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignatureTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignatureTest.java @@ -1033,8 +1033,7 @@ public void testCustomKeyInfoElementCreation() throws Exception { // Create the KeyInfo DocumentBuilderFactory docBuilderFactory = - SecureDocumentBuilderFactory.newInstance(); - docBuilderFactory.setNamespaceAware(true); + SecureDocumentBuilderFactory.newNSInstance(); DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder(); Document keyInfoDoc = docBuilder.newDocument(); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/DerivedKeyTokenTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/DerivedKeyTokenTest.java index 59e157034..5d8fa3ec1 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/DerivedKeyTokenTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/DerivedKeyTokenTest.java @@ -95,8 +95,7 @@ private static org.w3c.dom.Document createReferenceDocument( template.replaceFirst("PLACEHOLDER1", placeholder1) .replaceFirst("PLACEHOLDER2", placeholder2).getBytes()); final javax.xml.parsers.DocumentBuilderFactory factory = SecureDocumentBuilderFactory - .newInstance(); - factory.setNamespaceAware(true); + .newNSInstance(); final javax.xml.parsers.DocumentBuilder builder = factory .newDocumentBuilder(); return builder.parse(in); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/ReferenceTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/ReferenceTest.java index fff032af0..406eb6500 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/ReferenceTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/ReferenceTest.java @@ -156,8 +156,7 @@ public void testHashcode() throws Exception{ ).getBytes() ); final javax.xml.parsers.DocumentBuilderFactory factory = - SecureDocumentBuilderFactory.newInstance(); - factory.setNamespaceAware(true); + SecureDocumentBuilderFactory.newNSInstance(); final javax.xml.parsers.DocumentBuilder builder = factory.newDocumentBuilder(); return builder.parse(in); } diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenTest.java index 81d06260b..5acea98e1 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenTest.java @@ -1030,8 +1030,7 @@ public void testAssertionWrapper() throws Exception { SAMLUtil.doSAMLCallback(callbackHandler, samlCallback); SamlAssertionWrapper samlAssertion = new SamlAssertionWrapper(samlCallback); - DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newInstance(); - dbf.setNamespaceAware(true); + DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newNSInstance(); Document doc = dbf.newDocumentBuilder().newDocument(); String assertionString = DOM2Writer.nodeToString(samlAssertion.toDOM(doc)); @@ -1060,8 +1059,7 @@ public void testAssertionWrapperNoDocument() throws Exception { // Convert String to DOM + into an assertionWrapper InputStream in = new ByteArrayInputStream(assertionString.getBytes()); - DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newInstance(); - dbf.setNamespaceAware(true); + DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newNSInstance(); Document newDoc = dbf.newDocumentBuilder().parse(in); SamlAssertionWrapper newAssertion = diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SignedSamlTokenHOKTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SignedSamlTokenHOKTest.java index e6360209e..c4a55243c 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SignedSamlTokenHOKTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SignedSamlTokenHOKTest.java @@ -711,8 +711,7 @@ public void testX509DataAndKeyValue() throws Exception { // Create the KeyInfo DocumentBuilderFactory docBuilderFactory = - SecureDocumentBuilderFactory.newInstance(); - docBuilderFactory.setNamespaceAware(true); + SecureDocumentBuilderFactory.newNSInstance(); DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder(); Document keyInfoDoc = docBuilder.newDocument(); diff --git a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/ext/AssertionSigningTest.java b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/ext/AssertionSigningTest.java index af7263ced..c6b7406aa 100644 --- a/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/ext/AssertionSigningTest.java +++ b/ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/ext/AssertionSigningTest.java @@ -82,8 +82,7 @@ public AssertionSigningTest() throws Exception { input.close(); ((Merlin) issuerCrypto).setKeyStore(keyStore); - dbf = SecureDocumentBuilderFactory.newInstance(); - dbf.setNamespaceAware(true); + dbf = SecureDocumentBuilderFactory.newNSInstance(); } /** diff --git a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java index 5ed173115..060f5a995 100644 --- a/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java +++ b/ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java @@ -83,8 +83,7 @@ protected PolicyEnforcer buildAndStartPolicyEngine(String policyString, boolean protected PolicyEnforcer buildAndStartPolicyEngine( String policyString, boolean replacePolicyElement, List> customAssertionBuilders) throws ParserConfigurationException, SAXException, IOException, WSSPolicyException { - DocumentBuilderFactory documentBuilderFactory = SecureDocumentBuilderFactory.newInstance(); - documentBuilderFactory.setNamespaceAware(true); + DocumentBuilderFactory documentBuilderFactory = SecureDocumentBuilderFactory.newNSInstance(); documentBuilderFactory.setValidating(false); DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder(); Document document = documentBuilder.parse( diff --git a/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/DocumentCreatorImpl.java b/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/DocumentCreatorImpl.java index 7f858f1e4..19e62f072 100644 --- a/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/DocumentCreatorImpl.java +++ b/ws-security-stax/src/main/java/org/apache/wss4j/stax/ext/DocumentCreatorImpl.java @@ -18,7 +18,6 @@ */ package org.apache.wss4j.stax.ext; -import javax.xml.XMLConstants; import javax.xml.parsers.DocumentBuilderFactory; import javax.xml.parsers.ParserConfigurationException; @@ -36,10 +35,7 @@ public class DocumentCreatorImpl implements DocumentCreator { private final DocumentBuilderFactory documentBuilderFactory; public DocumentCreatorImpl() throws ParserConfigurationException { - documentBuilderFactory = SecureDocumentBuilderFactory.newInstance(); - documentBuilderFactory.setNamespaceAware(true); - documentBuilderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); - documentBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); + documentBuilderFactory = SecureDocumentBuilderFactory.newNSInstance(); } public Document newDocument() throws ParserConfigurationException { diff --git a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AbstractTestBase.java b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AbstractTestBase.java index 432dd953a..955f1df8f 100644 --- a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AbstractTestBase.java +++ b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/AbstractTestBase.java @@ -107,13 +107,11 @@ public abstract class AbstractTestBase { } public AbstractTestBase() { - documentBuilderFactory = SecureDocumentBuilderFactory.newInstance(); - documentBuilderFactory.setNamespaceAware(true); + documentBuilderFactory = SecureDocumentBuilderFactory.newNSInstance(); documentBuilderFactory.setIgnoringComments(false); documentBuilderFactory.setCoalescing(false); documentBuilderFactory.setIgnoringElementContentWhitespace(false); xmlInputFactory.setProperty(XMLInputFactory.IS_COALESCING, false); - xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false); //xmlInputFactory.setProperty(WstxInputProperties.P_MIN_TEXT_SEGMENT, new Integer(5 * 8192)); } diff --git a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/FaultTest.java b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/FaultTest.java index 411cb71a4..a5d444fd8 100644 --- a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/FaultTest.java +++ b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/FaultTest.java @@ -103,8 +103,7 @@ public void testUnsecuredFaultInbound() throws Exception { ByteArrayOutputStream baos = new ByteArrayOutputStream(); { InputStream sourceDocument = this.getClass().getClassLoader().getResourceAsStream("testdata/soap-fault.xml"); - DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); - factory.setNamespaceAware(true); + DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newNSInstance(); DocumentBuilder builder = factory.newDocumentBuilder(); Document securedDocument = builder.parse(sourceDocument); diff --git a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLCallbackHandlerImpl.java b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLCallbackHandlerImpl.java index 4d69651db..d00b41e2b 100644 --- a/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLCallbackHandlerImpl.java +++ b/ws-security-stax/src/test/java/org/apache/wss4j/stax/test/saml/SAMLCallbackHandlerImpl.java @@ -203,8 +203,7 @@ protected KeyInfoBean createKeyInfo() throws Exception { } else if (statement == Statement.ATTR) { // Build a new Document DocumentBuilderFactory docBuilderFactory = - SecureDocumentBuilderFactory.newInstance(); - docBuilderFactory.setNamespaceAware(true); + SecureDocumentBuilderFactory.newNSInstance(); DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder(); Document doc = docBuilder.newDocument(); From 5a766e1c1db52e6688f1194b3f12b04cf4e0bf62 Mon Sep 17 00:00:00 2001 From: Gary Gregory Date: Sun, 13 Sep 2026 19:23:11 +0000 Subject: [PATCH 5/6] Harden XML parsing via commons-secure-xml --- .../src/test/java/org/apache/wss4j/common/util/SOAPUtil.java | 3 +-- .../src/main/java/org/apache/wss4j/stax/setup/WSSec.java | 1 - 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java b/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java index 92d7aaff1..0e7a23d06 100644 --- a/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java +++ b/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java @@ -44,11 +44,10 @@ public class SOAPUtil { private static final org.slf4j.Logger LOG = org.slf4j.LoggerFactory.getLogger(SOAPUtil.class); - private static DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); + private static DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newNSInstance(); private static MessageFactory saajFactory = null; static { - factory.setNamespaceAware(true); try { saajFactory = MessageFactory.newInstance(); } catch (Exception e) { diff --git a/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/WSSec.java b/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/WSSec.java index dbf54a0a5..3a44f0720 100644 --- a/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/WSSec.java +++ b/ws-security-stax/src/main/java/org/apache/wss4j/stax/setup/WSSec.java @@ -463,7 +463,6 @@ public static WSSSecurityProperties validateAndApplyDefaultsToInboundSecurityPro public static Schema loadWSSecuritySchemas() throws SAXException { SchemaFactory schemaFactory = SecureSchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); - schemaFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, Boolean.TRUE); schemaFactory.setResourceResolver(new LSResourceResolver() { @Override public LSInput resolveResource(String type, String namespaceURI, String publicId, String systemId, String baseURI) { From 4d28150e5377e598ad2b338977639606775df48d Mon Sep 17 00:00:00 2001 From: Gary Gregory Date: Sun, 13 Sep 2026 22:09:27 +0000 Subject: [PATCH 6/6] Sentence starts with a capital letter. --- .../src/test/java/org/apache/wss4j/common/util/SOAPUtil.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java b/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java index 0e7a23d06..68140aa3c 100644 --- a/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java +++ b/ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java @@ -51,7 +51,7 @@ public class SOAPUtil { try { saajFactory = MessageFactory.newInstance(); } catch (Exception e) { - LOG.debug("can't create SAAJ MessageFactory", e); + LOG.debug("Can't create SAAJ MessageFactory", e); } }