Harden XML parsing via commons-secure-xml

integration/pom.xml

@@ -45,6 +45,10 @@
     </build>
 
     <dependencies>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-secure-xml</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.apache.wss4j</groupId>
             <artifactId>wss4j-ws-security-common</artifactId>

integration/src/test/java/org/apache/wss4j/integration/test/kerberos/KerberosTest.java

@@ -42,6 +42,9 @@
 import javax.xml.transform.dom.DOMSource;
 import javax.xml.transform.stream.StreamResult;
 
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
+import org.apache.commons.xml.secure.SecureTransformerFactory;
+import org.apache.commons.xml.secure.SecureXMLInputFactory;
 import org.apache.kerby.kerberos.kerb.server.SimpleKdcServer;
 import org.apache.wss4j.common.ext.WSSecurityException;
 import org.apache.wss4j.common.kerberos.KerberosContextAndServiceNameCallback;
@@ -90,8 +93,8 @@ public class KerberosTest {
     private static final org.slf4j.Logger LOG =
         org.slf4j.LoggerFactory.getLogger(KerberosTest.class);
 
-    private static final XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance();
-    private static final TransformerFactory TRANSFORMER_FACTORY = TransformerFactory.newInstance();
+    private static final XMLInputFactory xmlInputFactory = SecureXMLInputFactory.newInstance();
+    private static final TransformerFactory TRANSFORMER_FACTORY = SecureTransformerFactory.newInstance();
     private static DocumentBuilderFactory dbf;
 
     private static boolean runTests = true;
@@ -135,8 +138,7 @@ public static void setUp() throws Exception {
             runTests = false;
         }
 
-        dbf = DocumentBuilderFactory.newInstance();
-        dbf.setNamespaceAware(true);
+        dbf = SecureDocumentBuilderFactory.newNSInstance();
         dbf.setIgnoringComments(false);
         dbf.setCoalescing(false);
         dbf.setIgnoringElementContentWhitespace(false);

parent/pom.xml

@@ -202,6 +202,11 @@
                  <artifactId>jakarta.xml.bind-api</artifactId>
                  <version>${xml.bind.api.version}</version>
             </dependency>
+            <dependency>
+                <groupId>org.apache.commons</groupId>
+                <artifactId>commons-secure-xml</artifactId>
+                <version>1.0.0</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 

ws-security-common/pom.xml

@@ -212,6 +212,10 @@
             <version>${opensaml.version}</version>
             <scope>compile</scope>
         </dependency>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-secure-xml</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.ehcache</groupId>
             <artifactId>ehcache</artifactId>

ws-security-common/src/main/java/org/apache/wss4j/common/util/XMLUtils.java

@@ -27,7 +27,6 @@
 import java.util.Collections;
 import java.util.List;
 
-import javax.xml.XMLConstants;
 import javax.xml.transform.Source;
 import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerException;
@@ -44,8 +43,11 @@
 import org.w3c.dom.NamedNodeMap;
 import org.w3c.dom.Node;
 import org.w3c.dom.Text;
+
 import org.xml.sax.InputSource;
 
+import org.apache.commons.xml.secure.SecureTransformerFactory;
+
 public final class XMLUtils {
 
     public static final String XMLNS_NS = "http://www.w3.org/2000/xmlns/";
@@ -139,16 +141,7 @@ public static void elementToStream(Element element, OutputStream out)
         throws TransformerException {
         DOMSource source = new DOMSource(element);
         StreamResult result = new StreamResult(out);
-
-        TransformerFactory transFactory = TransformerFactory.newInstance();
-        transFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
-        try {
-            transFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
-            transFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
-        } catch (IllegalArgumentException ex) { //NOPMD
-            // ignore
-        }
-
+        TransformerFactory transFactory = SecureTransformerFactory.newInstance();
         Transformer transformer = transFactory.newTransformer();
         transformer.transform(source, result);
     }

ws-security-common/src/test/java/org/apache/wss4j/common/util/SOAPUtil.java

@@ -21,7 +21,10 @@
 
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
+
 import jakarta.xml.soap.MessageFactory;
+
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
 import java.io.ByteArrayInputStream;
 import java.io.InputStream;
 
@@ -41,15 +44,14 @@ public class SOAPUtil {
 
     private static final org.slf4j.Logger LOG = org.slf4j.LoggerFactory.getLogger(SOAPUtil.class);
 
-    private static DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+    private static DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newNSInstance();
     private static MessageFactory saajFactory = null;
 
     static {
-        factory.setNamespaceAware(true);
         try {
             saajFactory = MessageFactory.newInstance();
         } catch (Exception e) {
-            LOG.debug("can't create SAAJ MessageFactory", e);
+            LOG.debug("Can't create SAAJ MessageFactory", e);
         }
     }
 

ws-security-dom/src/test/java/org/apache/wss4j/dom/common/AbstractSAMLCallbackHandler.java

@@ -20,6 +20,7 @@
 package org.apache.wss4j.dom.common;
 
 import org.apache.wss4j.dom.WSConstants;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
 import org.apache.wss4j.common.crypto.Crypto;
 import org.apache.wss4j.common.saml.SAMLCallback;
 import org.apache.wss4j.common.saml.bean.ActionBean;
@@ -235,8 +236,7 @@ protected KeyInfoBean createKeyInfo() throws Exception {
         } else if (statement == Statement.ATTR) {
             // Build a new Document
             DocumentBuilderFactory docBuilderFactory =
-                DocumentBuilderFactory.newInstance();
-            docBuilderFactory.setNamespaceAware(true);
+                SecureDocumentBuilderFactory.newNSInstance();
             DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder();
             Document doc = docBuilder.newDocument();
 

ws-security-dom/src/test/java/org/apache/wss4j/dom/common/SAMLElementCallbackHandler.java

@@ -26,6 +26,7 @@
 import javax.xml.parsers.DocumentBuilderFactory;
 
 import org.apache.wss4j.common.saml.SamlAssertionWrapper;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
 import org.apache.wss4j.common.saml.SAMLCallback;
 import org.apache.wss4j.common.saml.SAMLUtil;
 import org.apache.wss4j.common.saml.builder.SAML1Constants;
@@ -75,7 +76,7 @@ private Element getSAMLAssertion() throws Exception {
 
         SamlAssertionWrapper samlAssertionWrapper = new SamlAssertionWrapper(samlCallback);
 
-        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+        DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance();
         return samlAssertionWrapper.toDOM(factory.newDocumentBuilder().newDocument());
     }
 

ws-security-dom/src/test/java/org/apache/wss4j/dom/components/crypto/CryptoProviderTest.java

@@ -24,6 +24,7 @@
 import org.apache.wss4j.dom.common.KeystoreCallbackHandler;
 
 import org.apache.wss4j.dom.engine.WSSecurityEngine;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
 import org.apache.wss4j.common.crypto.Crypto;
 import org.apache.wss4j.common.crypto.CryptoFactory;
 import org.apache.wss4j.common.ext.WSSecurityException;
@@ -120,8 +121,7 @@ public void testSignatureEmailAddress() throws Exception {
             outputString.replace("1.2.840.113549.1.9.1=#16125765726e6572406578616d706c652e636f6d",
                              "EMAILADDRESS=Werner@example.com");
 
-        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
-        dbf.setNamespaceAware(true);
+        DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newNSInstance();
         InputStream is = new ByteArrayInputStream(outputString.getBytes());
         Document parsedDoc = dbf.newDocumentBuilder().parse(is);
         verify(parsedDoc);
@@ -148,8 +148,7 @@ public void testSignatureOtherEmailAddress() throws Exception {
             outputString.replace("1.2.840.113549.1.9.1=#16125765726e6572406578616d706c652e636f6d",
                              "E=Werner@example.com");
 
-        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
-        dbf.setNamespaceAware(true);
+        DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newNSInstance();
         InputStream is = new ByteArrayInputStream(outputString.getBytes());
         Document parsedDoc = dbf.newDocumentBuilder().parse(is);
         verify(parsedDoc);

ws-security-dom/src/test/java/org/apache/wss4j/dom/handler/CustomTokenTest.java

@@ -28,6 +28,7 @@
 import javax.security.auth.callback.UnsupportedCallbackException;
 import javax.xml.parsers.DocumentBuilderFactory;
 
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
 import org.apache.wss4j.common.ext.WSPasswordCallback;
 import org.apache.wss4j.common.util.SOAPUtil;
 import org.apache.wss4j.common.util.XMLUtils;
@@ -58,8 +59,7 @@ public class CustomTokenTest {
     @Test
     public void testCustomTokenTimestamp() throws Exception {
         // Create a Timestamp manually
-        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
-        dbf.setNamespaceAware(true);
+        DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newNSInstance();
         Document timestampDoc = dbf.newDocumentBuilder().newDocument();
 
         WSSecTimestamp timestamp = new WSSecTimestamp(timestampDoc);

ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignaturePrefixListTest.java

@@ -32,6 +32,7 @@
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
 import org.apache.wss4j.common.crypto.Crypto;
 import org.apache.wss4j.common.crypto.CryptoFactory;
 import org.apache.wss4j.common.crypto.CryptoType;
@@ -72,8 +73,7 @@ public void testDuplicatePrefixListValues() throws Exception {
         Document doc = null;
         try (InputStream inputStream =
             Loader.getResource("org/apache/wss4j/dom/message/SignaturePrefixListMessage.xml").openStream()) {
-            DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-            factory.setNamespaceAware(true);
+            DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newNSInstance();
             DocumentBuilder builder = factory.newDocumentBuilder();
             doc = builder.parse(inputStream);
         }

ws-security-dom/src/test/java/org/apache/wss4j/dom/message/SignatureTest.java

@@ -35,6 +35,7 @@
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
 import org.apache.wss4j.common.WSEncryptionPart;
 import org.apache.wss4j.common.bsp.BSPRule;
 import org.apache.wss4j.common.crypto.Crypto;
@@ -1032,8 +1033,7 @@ public void testCustomKeyInfoElementCreation() throws Exception {
 
         // Create the KeyInfo
         DocumentBuilderFactory docBuilderFactory =
-            DocumentBuilderFactory.newInstance();
-        docBuilderFactory.setNamespaceAware(true);
+            SecureDocumentBuilderFactory.newNSInstance();
         DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder();
         Document keyInfoDoc = docBuilder.newDocument();
 

ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/DerivedKeyTokenTest.java

@@ -19,6 +19,7 @@
 
 package org.apache.wss4j.dom.message.token;
 
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
 import org.apache.wss4j.common.bsp.BSPEnforcer;
 
 
@@ -93,9 +94,8 @@ private static org.w3c.dom.Document createReferenceDocument(
         final java.io.InputStream in = new java.io.ByteArrayInputStream(
                 template.replaceFirst("PLACEHOLDER1", placeholder1)
                         .replaceFirst("PLACEHOLDER2", placeholder2).getBytes());
-        final javax.xml.parsers.DocumentBuilderFactory factory = javax.xml.parsers.DocumentBuilderFactory
-                .newInstance();
-        factory.setNamespaceAware(true);
+        final javax.xml.parsers.DocumentBuilderFactory factory = SecureDocumentBuilderFactory
+                .newNSInstance();
         final javax.xml.parsers.DocumentBuilder builder = factory
                 .newDocumentBuilder();
         return builder.parse(in);

ws-security-dom/src/test/java/org/apache/wss4j/dom/message/token/ReferenceTest.java

@@ -19,6 +19,7 @@
 
 package org.apache.wss4j.dom.message.token;
 
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
 import org.apache.wss4j.common.ext.WSSecurityException;
 import org.apache.wss4j.common.token.Reference;
 
@@ -155,8 +156,7 @@ public void testHashcode() throws Exception{
                 ).getBytes()
             );
         final javax.xml.parsers.DocumentBuilderFactory factory =
-            javax.xml.parsers.DocumentBuilderFactory.newInstance();
-        factory.setNamespaceAware(true);
+            SecureDocumentBuilderFactory.newNSInstance();
         final javax.xml.parsers.DocumentBuilder builder = factory.newDocumentBuilder();
         return builder.parse(in);
     }

ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SamlTokenTest.java

@@ -35,6 +35,7 @@
 import javax.security.auth.callback.CallbackHandler;
 import javax.xml.parsers.DocumentBuilderFactory;
 
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
 import org.apache.wss4j.common.bsp.BSPRule;
 import org.apache.wss4j.common.crypto.Crypto;
 import org.apache.wss4j.common.crypto.CryptoFactory;
@@ -1029,8 +1030,7 @@ public void testAssertionWrapper() throws Exception {
         SAMLUtil.doSAMLCallback(callbackHandler, samlCallback);
         SamlAssertionWrapper samlAssertion = new SamlAssertionWrapper(samlCallback);
 
-        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
-        dbf.setNamespaceAware(true);
+        DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newNSInstance();
         Document doc = dbf.newDocumentBuilder().newDocument();
         String assertionString = DOM2Writer.nodeToString(samlAssertion.toDOM(doc));
 
@@ -1059,8 +1059,7 @@ public void testAssertionWrapperNoDocument() throws Exception {
         // Convert String to DOM + into an assertionWrapper
         InputStream in = new ByteArrayInputStream(assertionString.getBytes());
 
-        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
-        dbf.setNamespaceAware(true);
+        DocumentBuilderFactory dbf = SecureDocumentBuilderFactory.newNSInstance();
         Document newDoc = dbf.newDocumentBuilder().parse(in);
 
         SamlAssertionWrapper newAssertion =

ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/SignedSamlTokenHOKTest.java

@@ -32,6 +32,7 @@
 import org.apache.wss4j.dom.engine.WSSecurityEngineResult;
 import org.apache.wss4j.dom.handler.RequestData;
 import org.apache.wss4j.dom.handler.WSHandlerResult;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
 import org.apache.wss4j.common.bsp.BSPRule;
 import org.apache.wss4j.common.crypto.Crypto;
 import org.apache.wss4j.common.crypto.CryptoFactory;
@@ -710,8 +711,7 @@ public void testX509DataAndKeyValue() throws Exception {
 
         // Create the KeyInfo
         DocumentBuilderFactory docBuilderFactory =
-            DocumentBuilderFactory.newInstance();
-        docBuilderFactory.setNamespaceAware(true);
+            SecureDocumentBuilderFactory.newNSInstance();
         DocumentBuilder docBuilder = docBuilderFactory.newDocumentBuilder();
         Document keyInfoDoc = docBuilder.newDocument();
 

ws-security-dom/src/test/java/org/apache/wss4j/dom/saml/ext/AssertionSigningTest.java

@@ -24,6 +24,7 @@
 
 import javax.xml.parsers.DocumentBuilderFactory;
 
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
 import org.apache.wss4j.common.crypto.Crypto;
 import org.apache.wss4j.common.crypto.CryptoType;
 import org.apache.wss4j.common.crypto.Merlin;
@@ -81,8 +82,7 @@ public AssertionSigningTest() throws Exception {
         input.close();
         ((Merlin) issuerCrypto).setKeyStore(keyStore);
 
-        dbf = DocumentBuilderFactory.newInstance();
-        dbf.setNamespaceAware(true);
+        dbf = SecureDocumentBuilderFactory.newNSInstance();
     }
 
     /**

ws-security-policy-stax/src/test/java/org/apache/wss4j/policy/stax/test/AbstractPolicyTestBase.java

@@ -18,6 +18,7 @@
  */
 package org.apache.wss4j.policy.stax.test;
 
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
 import org.apache.neethi.builders.AssertionBuilder;
 import org.apache.wss4j.common.crypto.WSProviderConfig;
 import org.apache.wss4j.common.ext.WSSecurityException;
@@ -82,8 +83,7 @@ protected PolicyEnforcer buildAndStartPolicyEngine(String policyString, boolean
     protected PolicyEnforcer buildAndStartPolicyEngine(
             String policyString, boolean replacePolicyElement, List<AssertionBuilder<Element>> customAssertionBuilders)
             throws ParserConfigurationException, SAXException, IOException, WSSPolicyException {
-        DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
-        documentBuilderFactory.setNamespaceAware(true);
+        DocumentBuilderFactory documentBuilderFactory = SecureDocumentBuilderFactory.newNSInstance();
         documentBuilderFactory.setValidating(false);
         DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder();
         Document document = documentBuilder.parse(