CVE-2017-7545: Improper Restriction of XML External Entity Reference (CWE-611)
value: It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML eXternal Entity (XXE) attacks.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 6.5
Published: 2018-07-26T15:29Z
Repository: https://github.com/kiegroup/jbpm-designer
Language: XML
Files changed: jbpm-designer-backend/pom.xml, jbpm-designer-backend/src/main/java/org/jbpm/designer/web/server/TransformerServlet.java, jbpm-designer-client/pom.xml, jbpm-designer-client/src/main/resources/org/jbpm/designer/public/js/Plugins/plugins.xml, jbpm-designer-client/src/main/resources/org/jbpm/designer/public/profiles/jbpm.xml
Commit date: 2017-10-10 06:12:32 -0700
Commit message: JBPM-6415 - Remove jPDL migration plugin and its use from jbpm-designer (#658) (#673)


Diff: diff --git a/jbpm-designer-backend/pom.xml b/jbpm-designer-backend/pom.xml
index 2ff1ad50f..b8f3217dd 100644
--- a/jbpm-designer-backend/pom.xml
+++ b/jbpm-designer-backend/pom.xml
@@ -141,34 +141,10 @@
     <dependency>
       <groupId>org.jbpm</groupId>
       <artifactId>jbpm-bpmn2-emfextmodel</artifactId>
     </dependency>
 
-    <!-- jBPM Migration -->
-    <dependency>
-      <groupId>org.jbpm.jbpm5</groupId>
-      <artifactId>jbpmmigration</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>log4j</groupId>
-          <artifactId>log4j</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>xml-apis</groupId>
-          <artifactId>xml-apis</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>xalan</groupId>
-          <artifactId>xalan</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>xerces</groupId>
-          <artifactId>xercesImpl</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-
     <!--  Drools -->
     <dependency>
       <groupId>org.drools</groupId>
       <artifactId>drools-core</artifactId>
     </dependency>
diff --git a/jbpm-designer-backend/src/main/java/org/jbpm/designer/web/server/TransformerServlet.java b/jbpm-designer-backend/src/main/java/org/jbpm/designer/web/server/TransformerServlet.java
index 00c99c68d..3e3f4d455 100644
--- a/jbpm-designer-backend/src/main/java/org/jbpm/designer/web/server/TransformerServlet.java
+++ b/jbpm-designer-backend/src/main/java/org/jbpm/designer/web/server/TransformerServlet.java
@@ -77,11 +77,10 @@ import org.jbpm.designer.repository.Repository;
 import org.jbpm.designer.repository.impl.AssetBuilder;
 import org.jbpm.designer.util.Utils;
 import org.jbpm.designer.web.profile.IDiagramProfile;
 import org.jbpm.designer.web.profile.IDiagramProfileService;
 import org.jbpm.designer.web.profile.impl.JbpmProfileImpl;
-import org.jbpm.migration.JbpmMigration;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 /**
  *
@@ -94,11 +93,10 @@ public class TransformerServlet extends HttpServlet {
     private static final long serialVersionUID = 1L;
     private static final Logger _logger = LoggerFactory.getLogger(TransformerServlet.class);
     private static final String TO_PDF = "pdf";
     private static final String TO_PNG = "png";
     private static final String TO_SVG = "svg";
-    private static final String JPDL_TO_BPMN2 = "jpdl2bpmn2";
     private static final String BPMN2_TO_JSON = "bpmn2json";
     private static final String JSON_TO_BPMN2 = "json2bpmn2";
     private static final String HTML_TO_PDF = "html2pdf";
     private static final String RESPACTION_SHOWURL = "showurl";
 
@@ -279,41 +277,12 @@ public class TransformerServlet extends HttpServlet {
             } catch (TranscoderException e) {
                 resp.sendError(500, e.getMessage());
             }
         } else if (transformto != null && transformto.equals(TO_SVG)) {
             storeInRepository(uuid, formattedSvg, transformto, processid, repository);
-        } else if (transformto != null && transformto.equals(JPDL_TO_BPMN2)) {
-            try {
-                String bpmn2 = JbpmMigration.transform(jpdl);
-                Definitions def = ((JbpmProfileImpl) profile).getDefinitions(bpmn2);
-                // add bpmndi info to Definitions with help of gpd
-                addBpmnDiInfo(def, gpd);
-                // hack for now
-                revisitSequenceFlows(def, bpmn2);
-                // another hack if id == name
-                revisitNodeNames(def);
 
-                // get the xml from Definitions
-                ResourceSet rSet = new ResourceSetImpl();
-                rSet.getResourceFactoryRegistry().getExtensionToFactoryMap().put("bpmn2", new JBPMBpmn2ResourceFactoryImpl());
-                JBPMBpmn2ResourceImpl bpmn2resource = (JBPMBpmn2ResourceImpl) rSet.createResource(URI.createURI("virtual.bpmn2"));
-                rSet.getResources().add(bpmn2resource);
-                bpmn2resource.getContents().add(def);
-                ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
-                bpmn2resource.save(outputStream, new HashMap<Object, Object>());
-                String fullXmlModel =  outputStream.toString();
-                // convert to json and write response
-                String json = profile.createUnmarshaller().parseModel(fullXmlModel, profile, pp);
-                resp.setCharacterEncoding("UTF-8");
-                resp.setContentType("application/json");
-                resp.getWriter().print(json);
-            } catch(Exception e) {
-                _logger.error(e.getMessage());
-                resp.setContentType("application/json");
-                resp.getWriter().print("{}");
-            }
-        }  else if (transformto != null && transformto.equals(BPMN2_TO_JSON)) {
+        } else if (transformto != null && transformto.equals(BPMN2_TO_JSON)) {
             try {
                 if(convertServiceTasks != null && convertServiceTasks.equals("true")) {
                     bpmn2in = bpmn2in.replaceAll("drools:taskName=\".*?\"", "drools:taskName=\"ReadOnlyService\"");
                     bpmn2in = bpmn2in.replaceAll("tns:taskName=\".*?\"", "tns:taskName=\"ReadOnlyService\"");
                 }
diff --git a/jbpm-designer-client/pom.xml b/jbpm-designer-client/pom.xml
index 9d80d5c5c..67a327002 100644
--- a/jbpm-designer-client/pom.xml
+++ b/jbpm-designer-client/pom.xml
@@ -346,11 +346,10 @@
               <insertNewLine>true</insertNewLine>
               <includes>
                 <include>${project.build.directory}/classes/org/jbpm/designer/public/js/Plugins/selectssperspective-min.js</include>
                 <include>${project.build.directory}/classes/org/jbpm/designer/public/js/Plugins/toolbar-min.js</include>
                 <include>${project.build.directory}/classes/org/jbpm/designer/public/js/Plugins/processinfo-min.js</include>
-                <include>${project.build.directory}/classes/org/jbpm/designer/public/js/Plugins/jpdlmigration-min.js</include>
                 <include>${project.build.directory}/classes/org/jbpm/designer/public/js/Plugins/servicerepo-min.js</include>
                 <include>${project.build.directory}/classes/org/jbpm/designer/public/js/Plugins/saveplugin-min.js</include>
                 <include>${project.build.directory}/classes/org/jbpm/designer/public/js/Plugins/shapemenu-min.js</include>
                 <include>${project.build.directory}/classes/org/jbpm/designer/public/js/Plugins/dataioeditor-min.js</include>
                 <include>${project.build.directory}/classes/org/jbpm/designer/public/js/Plugins/shaperepository.js</include>
diff --git a/jbpm-designer-client/src/main/resources/org/jbpm/designer/public/js/Plugins/jpdlmigration.js b/jbpm-designer-client/src/main/resources/org/jbpm/designer/public/js/Plugins/jpdlmigration.js
deleted file mode 100644
index 38b62e49e..000000000
--- a/jbpm-designer-client/src/main/resources/org/jbpm/designer/public/js/Plugins/jpdlmigration.js
+++ /dev/null
@@ -1,230 +0,0 @@
-if (!ORYX.Plugins) 
-    ORYX.Plugins = {};
-
-if (!ORYX.Config)
-	ORYX.Config = {};
-
-ORYX.Plugins.JPDLMigration = Clazz.extend({
-	construct: function(facade){
-		this.facade = facade;
-
-        if(!(ORYX.READONLY == true || ORYX.VIEWLOCKED == true)) {
-            this.facade.offer({
-                'name':ORYX.I18N.View.migratejPDL,
-                'functionality': this.migrateJPDL.bind(this),
-                'group': 'importgroup',
-                'icon': ORYX.BASE_FILE_PATH + "images/jpdl_import_icon.png",
-                dropDownGroupIcon : ORYX.BASE_FILE_PATH + "images/import.png",
-                'description': ORYX.I18N.View.migratejPDLDesc,
-                'index': 3,
-                'minShape': 0,
-                'maxShape': 0,
-                'isEnabled': function(){
-                    return !(ORYX.READONLY == true || ORYX.VIEWLOCKED == true);
-    //				profileParamName = "profile";
-    //				profileParamName = profileParamName.replace(/[\[]/,"\\\[").replace(/[\]]/,"\\\]");
-    //				regexSa = "[\\?&]"+profileParamName+"=([^&#]*)";
-    //		        regexa = new RegExp( regexSa );
-    //		        profileParams = regexa.exec( window.location.href );
-    //		        profileParamValue = profileParams[1];
-    //				return profileParamValue == "jbpm";
-                }.bind(this)
-            });
-        }
-	},
-	
-	migrateJPDL : function() {
-		this._showImportDialog();
-	},
-	_showImportDialog: function( successCallback ) {
-		var dialogSize = ORYX.Utils.getDialogSize(450, 500);
-		var panelHeight = Math.max(50, (dialogSize.height - 150) / 2);
-		var panelWidth = dialogSize.width - 50;
-
-	    var form = new Ext.form.FormPanel({
-		baseCls: 		'x-plain',
-	        labelWidth: 	50,
-	        defaultType: 	'textfield',
-	        items: [
-	        {
-	            text : 		ORYX.I18N.jPDLSupport.selectFile, 
-				style : 	'font-size:12px;margin-bottom:10px;display:block;',
-	            //anchor:		'100%',
-				xtype : 	'label' 
-	        },
-	        {
-	            fieldLabel: ORYX.I18N.jPDLSupport.file,
-	            name: 		'subject',
-				inputType : 'file',
-				style : 	'margin-bottom:10px;display:block;',
-				itemCls :	'ext_specific_window_overflow'
-	        }, 
-	        {
-	            xtype: 'textarea',
-	            hideLabel: true,
-	            name: 'msg',
-		        grow: false,
-				width: panelWidth,
-				height: panelHeight
-	        }
-	        ]
-	    });
-	    
-	    var form2 = new Ext.form.FormPanel({
-			baseCls: 		'x-plain',
-	        labelWidth: 	50,
-	        defaultType: 	'textfield',
-	        items: [
-	        {
-	            text : 		ORYX.I18N.jPDLSupport.selectGpdFile, 
-				style : 	'font-size:12px;margin-bottom:10px;display:block;',
-	            //anchor:		'100%',
-				xtype : 	'label' 
-	        },
-	        {
-	            fieldLabel: ORYX.I18N.jPDLSupport.gpdfile,
-	            name: 		'subject',
-				inputType : 'file',
-				style : 	'margin-bottom:10px;display:block;',
-				itemCls :	'ext_specific_window_overflow'
-	        }, 
-	        {
-	            xtype: 'textarea',
-	            hideLabel: true,
-	            name: 'msg',
-		        grow: false,
-                width: panelWidth,
-                height: panelHeight
-	        }
-	        ]
-	    });
-
-		// Create the panel
-		var dialog = new Ext.Window({ 
-			autoCreate: true,
-			autoScroll:true, 
-			//layout: 	'fit',
-			plain:		true,
-			bodyStyle: 	'padding:5px;',
-			title: 		ORYX.I18N.jPDLSupport.impJPDL, 
-			height: 	dialogSize.height,
-			width:		dialogSize.width,
-			modal:		true,
-			fixedcenter:true, 
-			shadow:		true, 
-			proxyDrag: 	true,
-			resizable:	true,
-			items: 		[form,form2],
-			buttons:[
-				{
-					text:ORYX.I18N.jPDLSupport.impBtn,
-					handler:function(){
-
-                        this.facade.raiseEvent({
-                            type 		: ORYX.CONFIG.EVENT_NOTIFICATION_SHOW,
-                            ntype		: 'info',
-                            msg         : ORYX.I18N.jPDLSupport.impProgress,
-                            title       : ''
-
-                        });
-
-						window.setTimeout(function(){
-					
-							var jpdlString =  form.items.items[2].getValue();
-							var gpdString =  form2.items.items[2].getValue();
-							
-							this._sendRequest(
-									ORYX.CONFIG.TRANSFORMER_URL(),
-									'POST',
-									{ 'jpdl' : jpdlString,
-									  'gpd'  : gpdString,
-									  'transformto' : 'jpdl2bpmn2',
-									  'profile' : ORYX.PROFILE,
-									  'uuid' :  window.btoa(encodeURI(ORYX.UUID))
-									},
-									function( arg ) { this._loadJSON( arg );  dialog.hide(); }.bind(this),
-									function() { dialog.hide(); }.bind(this)
-								);
-
-						}.bind(this), 100);
-			
-					}.bind(this)
-				},{
-					text:ORYX.I18N.jPDLSupport.close,
-					handler:function(){
-						
-						dialog.hide();
-					
-					}.bind(this)
-				}
-			]
-		});
-		
-		// Destroy the panel when hiding
-		dialog.on('hide', function(){
-			dialog.destroy(true);
-			delete dialog;
-		});
-
-		// Show the panel
-		dialog.show();
-				
-		// Adds the change event handler to 
-		form.items.items[1].getEl().dom.addEventListener('change',function(evt){
-			var reader = new FileReader();
-			reader.onload = function(e) { 
-				form.items.items[2].setValue( e.target.result ); 
-			} 
-			reader.readAsText(evt.target.files[0], 'UTF-8');
-		}, true);
-		form2.items.items[1].getEl().dom.addEventListener('change',function(evt){
-			var reader = new FileReader();
-			reader.onload = function(e) { 
-				form2.items.items[2].setValue( e.target.result ); 
-			} 
-			reader.readAsText(evt.target.files[0], 'UTF-8');
-        }, true);
-	},
-	_loadJSON: function( jsonString ){
-		if (jsonString) {
-			var jsonObj = jsonString.evalJSON();
-			this.facade.importJSON(jsonString);
-		} else {
-			this._showErrorMessageBox(ORYX.I18N.Oryx.title, ORYX.I18N.jPDLSupport.impFailedJson);
-		}
-	},
-	_sendRequest: function( url, method, params, successcallback, failedcallback ){
-
-		var suc = false;
-
-		new Ajax.Request(url, {
-           method			: method,
-           asynchronous	: false,
-           parameters		: params,
-		   onSuccess		: function(transport) {
-				
-				suc = true;
-				
-				if(successcallback){
-					successcallback( transport.responseText )	
-				}
-				
-			}.bind(this),
-			
-			onFailure		: function(transport) {
-
-				if(failedcallback){
-					
-					failedcallback();
-					
-				} else {
-					this._showErrorMessageBox(ORYX.I18N.Oryx.title, ORYX.I18N.jPDLSupport.impFailedReq);
-					ORYX.log.warn("jPDL migration failed: " + transport.responseText);	
-				}
-				
-			}.bind(this)		
-		});
-		
-		return suc;		
-	}
-});
\ No newline at end of file
diff --git a/jbpm-designer-client/src/main/resources/org/jbpm/designer/public/js/Plugins/plugins.xml b/jbpm-designer-client/src/main/resources/org/jbpm/designer/public/js/Plugins/plugins.xml
index e45fce154..538c7b213 100644
--- a/jbpm-designer-client/src/main/resources/org/jbpm/designer/public/js/Plugins/plugins.xml
+++ b/jbpm-designer-client/src/main/resources/org/jbpm/designer/public/js/Plugins/plugins.xml
@@ -32,12 +32,11 @@
 
 		<plugin source="jpdlSupport.js" name="ORYX.Plugins.JPDLSupport">
 			<requires namespace="http://b3mn.org/stencilset/bpmn1.1#" />
 			<!-- plugin loads dynamically the needed extension <requires namespace="http://oryx-editor.org/stencilsets/extensions/jbpm#"/> -->
 		</plugin>
-		
-		<plugin source="jpdlmigration.js" name="ORYX.Plugins.JPDLMigration"/>
+
 		<plugin source="servicerepo.js"   name="ORYX.Plugins.ServiceRepoIntegration"/>
 
 		<!-- User Interface Aggregation -->
 		<plugin source="bpmn2xforms.js" name="ORYX.Plugins.BPMN2XForms">
 			<requires namespace="http://b3mn.org/stencilset/bpmn1.1#" />
diff --git a/jbpm-designer-client/src/main/resources/org/jbpm/designer/public/profiles/jbpm.xml b/jbpm-designer-client/src/main/resources/org/jbpm/designer/public/profiles/jbpm.xml
index 7f5f124b7..e40f8217d 100644
--- a/jbpm-designer-client/src/main/resources/org/jbpm/designer/public/profiles/jbpm.xml
+++ b/jbpm-designer-client/src/main/resources/org/jbpm/designer/public/profiles/jbpm.xml
@@ -2,11 +2,10 @@
 
 <profiles>
     <profile name="jbpm" stencilset="bpmn2.0jbpm">
         <plugin name="ORYX.Plugins.SelectStencilSetPerspective"/>
         <plugin name="ORYX.Plugins.Toolbar"/>
-        <plugin name="ORYX.Plugins.JPDLMigration"/>
         <plugin name="ORYX.Plugins.ServiceRepoIntegration"/>
         <plugin name="ORYX.Plugins.SavePlugin"/>
         <plugin name="ORYX.Plugins.ShapeMenuPlugin"/>
         <plugin name="ORYX.Plugins.DataIOEditorPlugin"/>
         <plugin name="ORYX.Plugins.ShapeRepository"/>

Vulnerable code:     <!-- jBPM Migration -->
    <dependency>
      <groupId>org.jbpm.jbpm5</groupId>
      <artifactId>jbpmmigration</artifactId>
      <exclusions>
        <exclusion>
          <groupId>log4j</groupId>
          <artifactId>log4j</artifactId>
        </exclusion>
        <exclusion>
          <groupId>xml-apis</groupId>
          <artifactId>xml-apis</artifactId>
        </exclusion>
        <exclusion>
          <groupId>xalan</groupId>
          <artifactId>xalan</artifactId>
        </exclusion>
        <exclusion>
          <groupId>xerces</groupId>
          <artifactId>xercesImpl</artifactId>
        </exclusion>
      </exclusions>
    </dependency>

import org.jbpm.migration.JbpmMigration;
    private static final String JPDL_TO_BPMN2 = "jpdl2bpmn2";
        } else if (transformto != null && transformto.equals(JPDL_TO_BPMN2)) {
            try {
                String bpmn2 = JbpmMigration.transform(jpdl);
                Definitions def = ((JbpmProfileImpl) profile).getDefinitions(bpmn2);
                // add bpmndi info to Definitions with help of gpd
                addBpmnDiInfo(def, gpd);
                // hack for now
                revisitSequenceFlows(def, bpmn2);
                // another hack if id == name
                revisitNodeNames(def);
                // get the xml from Definitions
                ResourceSet rSet = new ResourceSetImpl();
                rSet.getResourceFactoryRegistry().getExtensionToFactoryMap().put("bpmn2", new JBPMBpmn2ResourceFactoryImpl());
                JBPMBpmn2ResourceImpl bpmn2resource = (JBPMBpmn2ResourceImpl) rSet.createResource(URI.createURI("virtual.bpmn2"));
                rSet.getResources().add(bpmn2resource);
                bpmn2resource.getContents().add(def);
                ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
                bpmn2resource.save(outputStream, new HashMap<Object, Object>());
                String fullXmlModel =  outputStream.toString();
                // convert to json and write response
                String json = profile.createUnmarshaller().parseModel(fullXmlModel, profile, pp);
                resp.setCharacterEncoding("UTF-8");
                resp.setContentType("application/json");
                resp.getWriter().print(json);
            } catch(Exception e) {
                _logger.error(e.getMessage());
                resp.setContentType("application/json");
                resp.getWriter().print("{}");
            }
        }  else if (transformto != null && transformto.equals(BPMN2_TO_JSON)) {
                <include>${project.build.directory}/classes/org/jbpm/designer/public/js/Plugins/jpdlmigration-min.js</include>
if (!ORYX.Plugins) 
    ORYX.Plugins = {};

if (!ORYX.Config)
	ORYX.Config = {};

ORYX.Plugins.JPDLMigration = Clazz.extend({
	construct: function(facade){
		this.facade = facade;

        if(!(ORYX.READONLY == true || ORYX.VIEWLOCKED == true)) {
            this.facade.offer({
                'name':ORYX.I18N.View.migratejPDL,
                'functionality': this.migrateJPDL.bind(this),
                'group': 'importgroup',
                'icon': ORYX.BASE_FILE_PATH + "images/jpdl_import_icon.png",
                dropDownGroupIcon : ORYX.BASE_FILE_PATH + "images/import.png",
                'description': ORYX.I18N.View.migratejPDLDesc,
                'index': 3,
                'minShape': 0,
                'maxShape': 0,
                'isEnabled': function(){
                    return !(ORYX.READONLY == true || ORYX.VIEWLOCKED == true);
    //				profileParamName = "profile";
    //				profileParamName = profileParamName.replace(/[\[]/,"\\\[").replace(/[\]]/,"\\\]");
    //				regexSa = "[\\?&]"+profileParamName+"=([^&#]*)";
    //		        regexa = new RegExp( regexSa );
    //		        profileParams = regexa.exec( window.location.href );
    //		        profileParamValue = profileParams[1];
    //				return profileParamValue == "jbpm";
                }.bind(this)
            });
        }
	},
	
	migrateJPDL : function() {
		this._showImportDialog();
	},
	_showImportDialog: function( successCallback ) {
		var dialogSize = ORYX.Utils.getDialogSize(450, 500);
		var panelHeight = Math.max(50, (dialogSize.height - 150) / 2);
		var panelWidth = dialogSize.width - 50;

	    var form = new Ext.form.FormPanel({
		baseCls: 		'x-plain',
	        labelWidth: 	50,
	        defaultType: 	'textfield',
	        items: [
	        {
	            text : 		ORYX.I18N.jPDLSupport.selectFile, 
				style : 	'font-size:12px;margin-bottom:10px;display:block;',
	            //anchor:		'100%',
				xtype : 	'label' 
	        },
	        {
	            fieldLabel: ORYX.I18N.jPDLSupport.file,
	            name: 		'subject',
				inputType : 'file',
				style : 	'margin-bottom:10px;display:block;',
				itemCls :	'ext_specific_window_overflow'
	        }, 
	        {
	            xtype: 'textarea',
	            hideLabel: true,
	            name: 'msg',
		        grow: false,
				width: panelWidth,
				height: panelHeight
	        }
	        ]
	    });
	    
	    var form2 = new Ext.form.FormPanel({
			baseCls: 		'x-plain',
	        labelWidth: 	50,
	        defaultType: 	'textfield',
	        items: [
	        {
	            text : 		ORYX.I18N.jPDLSupport.selectGpdFile, 
				style : 	'font-size:12px;margin-bottom:10px;display:block;',
	            //anchor:		'100%',
				xtype : 	'label' 
	        },
	        {
	            fieldLabel: ORYX.I18N.jPDLSupport.gpdfile,
	            name: 		'subject',
				inputType : 'file',
				style : 	'margin-bottom:10px;display:block;',
				itemCls :	'ext_specific_window_overflow'
	        }, 
	        {
	            xtype: 'textarea',
	            hideLabel: true,
	            name: 'msg',
		        grow: false,
                width: panelWidth,
                height: panelHeight
	        }
	        ]
	    });

		// Create the panel
		var dialog = new Ext.Window({ 
			autoCreate: true,
			autoScroll:true, 
			//layout: 	'fit',
			plain:		true,
			bodyStyle: 	'padding:5px;',
			title: 		ORYX.I18N.jPDLSupport.impJPDL, 
			height: 	dialogSize.height,
			width:		dialogSize.width,
			modal:		true,
			fixedcenter:true, 
			shadow:		true, 
			proxyDrag: 	true,
			resizable:	true,
			items: 		[form,form2],
			buttons:[
				{
					text:ORYX.I18N.jPDLSupport.impBtn,
					handler:function(){

                        this.facade.raiseEvent({
                            type 		: ORYX.CONFIG.EVENT_NOTIFICATION_SHOW,
                            ntype		: 'info',
                            msg         : ORYX.I18N.jPDLSupport.impProgress,
                            title       : ''

                        });

						window.setTimeout(function(){
					
							var jpdlString =  form.items.items[2].getValue();
							var gpdString =  form2.items.items[2].getValue();
							
							this._sendRequest(
									ORYX.CONFIG.TRANSFORMER_URL(),
									'POST',
									{ 'jpdl' : jpdlString,
									  'gpd'  : gpdString,
									  'transformto' : 'jpdl2bpmn2',
									  'profile' : ORYX.PROFILE,
									  'uuid' :  window.btoa(encodeURI(ORYX.UUID))
									},
									function( arg ) { this._loadJSON( arg );  dialog.hide(); }.bind(this),
									function() { dialog.hide(); }.bind(this)
								);

						}.bind(this), 100);
			
					}.bind(this)
				},{
					text:ORYX.I18N.jPDLSupport.close,
					handler:function(){
						
						dialog.hide();
					
					}.bind(this)
				}
			]
		});
		
		// Destroy the panel when hiding
		dialog.on('hide', function(){
			dialog.destroy(true);
			delete dialog;
		});

		// Show the panel
		dialog.show();
				
		// Adds the change event handler to 
		form.items.items[1].getEl().dom.addEventListener('change',function(evt){
			var reader = new FileReader();
			reader.onload = function(e) { 
				form.items.items[2].setValue( e.target.result ); 
			} 
			reader.readAsText(evt.target.files[0], 'UTF-8');
		}, true);
		form2.items.items[1].getEl().dom.addEventListener('change',function(evt){
			var reader = new FileReader();
			reader.onload = function(e) { 
				form2.items.items[2].setValue( e.target.result ); 
			} 
			reader.readAsText(evt.target.files[0], 'UTF-8');
        }, true);
	},
	_loadJSON: function( jsonString ){
		if (jsonString) {
			var jsonObj = jsonString.evalJSON();
			this.facade.importJSON(jsonString);
		} else {
			this._showErrorMessageBox(ORYX.I18N.Oryx.title, ORYX.I18N.jPDLSupport.impFailedJson);
		}
	},
	_sendRequest: function( url, method, params, successcallback, failedcallback ){

		var suc = false;

		new Ajax.Request(url, {
           method			: method,
           asynchronous	: false,
           parameters		: params,
		   onSuccess		: function(transport) {
				
				suc = true;
				
				if(successcallback){
					successcallback( transport.responseText )	
				}
				
			}.bind(this),
			
			onFailure		: function(transport) {

				if(failedcallback){
					
					failedcallback();
					
				} else {
					this._showErrorMessageBox(ORYX.I18N.Oryx.title, ORYX.I18N.jPDLSupport.impFailedReq);
					ORYX.log.warn("jPDL migration failed: " + transport.responseText);	
				}
				
			}.bind(this)		
		});
		
		return suc;		
	}
});
		
		<plugin source="jpdlmigration.js" name="ORYX.Plugins.JPDLMigration"/>
        <plugin name="ORYX.Plugins.JPDLMigration"/>
Fixed code:         } else if (transformto != null && transformto.equals(BPMN2_TO_JSON)) {