Code improvements to  WorkFlowManagmentUtil class
package org.wso2.carbon.identity.workflow.mgt.util;
-
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.wso2.carbon.context.CarbonContext;
@@ -9,10 +8,10 @@ import org.wso2.carbon.identity.workflow.mgt.exception.WorkflowException;
import org.wso2.carbon.identity.workflow.mgt.exception.WorkflowRuntimeException;
import org.wso2.carbon.user.api.UserStoreException;
import org.wso2.carbon.user.core.UserCoreConstants;
+import org.xml.sax.InputSource;
+import org.xml.sax.SAXException;
+import org.xml.sax.XMLReader;
-import javax.xml.bind.JAXBContext;
-import javax.xml.bind.JAXBException;
-import javax.xml.bind.Unmarshaller;
import java.io.BufferedInputStream;
import java.io.ByteArrayInputStream;
import java.io.IOException;
@@ -20,6 +19,13 @@ import java.io.InputStream;
import java.net.URISyntaxException;
import java.util.Arrays;
import java.util.List;
+import javax.xml.bind.JAXBContext;
+import javax.xml.bind.JAXBException;
+import javax.xml.bind.Unmarshaller;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.parsers.SAXParserFactory;
+import javax.xml.transform.Source;
+import javax.xml.transform.sax.SAXSource;
public class WorkflowManagementUtil {
private static Log log = LogFactory.getLog(WorkflowManagementUtil.class);
@@ -114,14 +120,34 @@ public class WorkflowManagementUtil {
public static <T> T unmarshalXML(String xmlString, Class<T> classType) throws JAXBException {
T t = null;
if (xmlString != null) {
- ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(xmlString.toString().getBytes());
+ ByteArrayInputStream byteArrayInputStream = new ByteArrayInputStream(xmlString.getBytes());
JAXBContext jaxbContext = JAXBContext.newInstance(classType);
+ try {
+ SAXParserFactory spf = getSecuredSAXParserFactory();
+ Source xmlSource = new SAXSource(getXmlReader(spf), new InputSource(byteArrayInputStream));
Unmarshaller jaxbUnmarshaller = jaxbContext.createUnmarshaller();
- t = (T) jaxbUnmarshaller.unmarshal(byteArrayInputStream);
+ t = (T) jaxbUnmarshaller.unmarshal(xmlSource);
+ } catch (SAXException | ParserConfigurationException e) {
+ log.error("Error while unmarshalling the XML String", e);
+ }
}
return t;
}
+ private static XMLReader getXmlReader(SAXParserFactory spf) throws SAXException, ParserConfigurationException {
+
+ return spf.newSAXParser().getXMLReader();
+ }
+
+ private static SAXParserFactory getSecuredSAXParserFactory() throws ParserConfigurationException, SAXException {
+ // Fix from https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#JAXB_Unmarshaller
+ SAXParserFactory spf = SAXParserFactory.newInstance();
+ spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
+ spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+ spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+
+ return spf;
+ }
/**
* Reading File Content from the resource path
