Project: mule
Issue MULE-7390: XSLT transformer is vulnerable to XXE
The current implementation of the XSLT transformer is vulnerable to the following threat: https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing Currently, there is no way to prevent this since it would require to: * Set the property 'javax.xml.stream.isSupportingExternalEntities' to false for the xmlInputFactory. Currently no property can be set XML factory at all. * Set the attribute of the transformer 'useStaxSource'. When this parameter is false (default) the XML factory is ignored. This attribute can't be set right now. We need to disable XXE by default and add an attribute which allows it when needed to keep backwards compatibility. Steps to reproduce: 1. Run the attached configuration. 2. Post the following XML to the endpoint http://localhost:9000/test: ]> &spi_entity_ref; 3. Inspect the content of the output and log. It will show the content of the /etc/passwd file. If you don't have it, you can change it to a file that you have in your filesystem.
Story points: 5