Class XmlSecurity

java.lang.Object
org.openehealth.ipf.commons.xml.XmlSecurity
public final class XmlSecurity extends Object
Applies XXE and SSRF countermeasures to the JAXP and Saxon components that process untrusted input.

Restricting a SchemaFactory does not restrict the Validator it produces: schema compilation and instance validation are separate parsers with separate settings, so both have to be hardened explicitly.

Every property is applied individually and failures are only logged, because the available settings depend on which JAXP implementation is in use — Saxon rejects several attributes that the JDK accepts and vice versa, and an unsupported name raises an exception rather than being ignored.

Since:
6.0

  • Method Details

    • harden

      public static void harden(SchemaFactory factory)
      Hardens schema compilation. Schemas are trusted classpath resources, so this is defense in depth only.

      XMLConstants.ACCESS_EXTERNAL_SCHEMA is restricted to local protocols rather than denied outright. The IHE schemas are split across many files that pull each other in via xs:import and xs:include, and enabling secure processing alone already denies all external schema access implicitly, which prevents any schema from compiling. Allowing file and jar keeps those imports working while still blocking network fetches. The instance-document side has no such need — see harden(Validator).

    • harden

      public static void harden(Validator validator)
      Hardens validation of an instance document. This is the important one: the document being validated is untrusted, and without these settings a DOCTYPE in it can read local files or make the validator issue outbound requests.

    • harden

      public static void harden(TransformerFactory factory)
      Hardens an XSLT transformer factory. Stylesheets are loaded from the classpath and are trusted, but the transformed document is not, and a transformer resolves external DTDs by default.

    • hardenForTrustedResources

      public static void hardenForTrustedResources(TransformerFactory factory)
      Variant of harden(TransformerFactory) for factories that only ever process trusted classpath resources, never inbound messages.

      Some of the bundled Schematron rule sets are assembled from entity files — HITSP_C32.sch pulls in 2.16.840.1.113883.10.20.2.7.ent, for example — so compiling them requires external entity resolution. Local protocols are therefore permitted here while network access stays blocked. Do not use this for a factory that transforms untrusted input: allowing file would let a DOCTYPE in an inbound document read local files.

    • harden

      public static void harden(net.sf.saxon.Configuration configuration)
      Hardens a Saxon configuration used for XQuery and XSLT. Disabling external functions is the significant control here: it stops a query from reaching arbitrary Java methods by reflection.