Vulnerability: oxf/xml/xerces/XercesSAXParserFactoryImpl.java in the xforms-server component in the XForms service in Orbeon Forms before 3.9 does not properly restrict DTDs in Ajax requests, which allows remote attackers to read arbitrary files or send HTTP requests to intranet servers via an entity declaration in conjunction with an entity reference, related to an "XML injection" issue.
Vulnerability ID: CVE-2010-3260
CWE: CWE-264
Severity score: 4.9
Project: https://github.com/orbeon/orbeon-forms
Published: 2011-04-27
File: src/java/org/orbeon/oxf/xml/xerces/XercesSAXParserFactoryImpl.java
Commit message: Implemented "[ #315668 ] Disable loading of external entities in XML parsing by default".
Commit author: ebruchez

Vulnerable version (before fix):
 import org.xml.sax.SAXException; import org.xml.sax.SAXNotRecognizedException;  import javax.xml.parsers.ParserConfigurationException; import javax.xml.parsers.SAXParser; import javax.xml.parsers.SAXParserFactory; import java.util.Collection; import java.util.Collections; import java.util.Hashtable; import java.util.Map;  /**  * Boasts a couple of improvements over the 'stock' xerces parser factory. public class XercesSAXParserFactoryImpl extends SAXParserFactory {     static {         {             final OrbeonParserConfiguration configuration = XercesSAXParser.makeConfig(false, true);             final Collection features = configuration.getRecognizedFeatures();             recognizedFeaturesNonValidatingXInclude = Collections.unmodifiableCollection(features);             defaultFeaturesNonValidatingXInclude = configuration.getFeatures();             // This was being done in XMLUtils.createSaxParserFactory before.  Maybe want to             // move it back if we decide to make this class more general purpose.             defaultFeaturesNonValidatingXInclude.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);             defaultFeaturesNonValidatingXInclude.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);         }         {             final OrbeonParserConfiguration configuration = XercesSAXParser.makeConfig(false, false);             final Collection features = configuration.getRecognizedFeatures();             recognizedFeaturesNonValidatingNoXInclude = Collections.unmodifiableCollection(features);             defaultFeaturesNonValidatingNoXInclude = configuration.getFeatures();             // This was being done in XMLUtils.createSaxParserFactory before.  Maybe want to             // move it back if we decide to make this class more general purpose.             defaultFeaturesNonValidatingNoXInclude.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);             defaultFeaturesNonValidatingNoXInclude.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);         }          {             final OrbeonParserConfiguration configuration = XercesSAXParser.makeConfig(true, true);             final Collection features = configuration.getRecognizedFeatures();             recognizedFeaturesValidatingXInclude = Collections.unmodifiableCollection(features);             defaultFeaturesValidatingXInclude = configuration.getFeatures();             // This was being done in XMLUtils.createSaxParserFactory before.  Maybe want to             // move it back if we decide to make this class more general purpose.             defaultFeaturesValidatingXInclude.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);             defaultFeaturesValidatingXInclude.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);         }         {             final OrbeonParserConfiguration configuration = XercesSAXParser.makeConfig(true, false);             final Collection features = configuration.getRecognizedFeatures();             recognizedFeaturesValidatingNoXInclude = Collections.unmodifiableCollection(features);             defaultFeaturesValidatingNoXInclude = configuration.getFeatures();             // This was being done in XMLUtils.createSaxParserFactory before.  Maybe want to             // move it back if we decide to make this class more general purpose.             defaultFeaturesValidatingNoXInclude.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);             defaultFeaturesValidatingNoXInclude.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);         }     }      private final Hashtable features;     private final boolean validating;     private final boolean handleXInclude; public void setFeature(final String key, final boolean val) throws SAXNotRecogni         features.put(key, val ? Boolean.TRUE : Boolean.FALSE);     }      public SAXParser newSAXParser() throws ParserConfigurationException {         final SAXParser ret;         try {             ret = new XercesJAXPSAXParser(this, features, validating, handleXInclude);         } catch (final SAXException se) {             // Translate to ParserConfigurationException             throw new OXFException(se); // so we see a decent stack trace! //            throw new ParserConfigurationException(se.getMessage());         }         return ret;     }

Fixed version (after fix):
 import org.xml.sax.SAXException; import org.xml.sax.SAXNotRecognizedException;  import javax.xml.parsers.SAXParser; import javax.xml.parsers.SAXParserFactory; import java.util.*;  /**  * Boasts a couple of improvements over the 'stock' xerces parser factory. public class XercesSAXParserFactoryImpl extends SAXParserFactory {     static {         {             final OrbeonParserConfiguration configuration = XercesSAXParser.makeConfig(false, true);             final Collection recognizedFeatures = configuration.getRecognizedFeatures();             recognizedFeaturesNonValidatingXInclude = Collections.unmodifiableCollection(recognizedFeatures);             defaultFeaturesNonValidatingXInclude = configuration.getFeatures();             addDefaultFeatures(defaultFeaturesNonValidatingXInclude);         }         {             final OrbeonParserConfiguration configuration = XercesSAXParser.makeConfig(false, false);             final Collection features = configuration.getRecognizedFeatures();             recognizedFeaturesNonValidatingNoXInclude = Collections.unmodifiableCollection(features);             defaultFeaturesNonValidatingNoXInclude = configuration.getFeatures();             addDefaultFeatures(defaultFeaturesNonValidatingNoXInclude);         }          {             final OrbeonParserConfiguration configuration = XercesSAXParser.makeConfig(true, true);             final Collection features = configuration.getRecognizedFeatures();             recognizedFeaturesValidatingXInclude = Collections.unmodifiableCollection(features);             defaultFeaturesValidatingXInclude = configuration.getFeatures();             addDefaultFeatures(defaultFeaturesValidatingXInclude);         }         {             final OrbeonParserConfiguration configuration = XercesSAXParser.makeConfig(true, false);             final Collection features = configuration.getRecognizedFeatures();             recognizedFeaturesValidatingNoXInclude = Collections.unmodifiableCollection(features);             defaultFeaturesValidatingNoXInclude = configuration.getFeatures();             addDefaultFeatures(defaultFeaturesValidatingNoXInclude);         }     }      private static void addDefaultFeatures(Map features) {         features.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);         features.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);         // For security purposes, disable external entities         features.put("http://xml.org/sax/features/external-general-entities", Boolean.FALSE);         features.put("http://xml.org/sax/features/external-parameter-entities", Boolean.FALSE);     }      private final Hashtable features;     private final boolean validating;     private final boolean handleXInclude; public void setFeature(final String key, final boolean val) throws SAXNotRecogni         features.put(key, val ? Boolean.TRUE : Boolean.FALSE);     }      public SAXParser newSAXParser() {         final SAXParser ret;         try {             ret = new XercesJAXPSAXParser(this, features, validating, handleXInclude);         } catch (final SAXException se) {             // Translate to ParserConfigurationException             throw new OXFException(se); // so we see a decent stack trace!         }         return ret;     }

Patch:
patch: @@ -4,13 +4,9 @@
 import org.xml.sax.SAXException;
 import org.xml.sax.SAXNotRecognizedException;
 
-import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
 import javax.xml.parsers.SAXParserFactory;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.Hashtable;
-import java.util.Map;
+import java.util.*;
 
 /**
  * Boasts a couple of improvements over the 'stock' xerces parser factory.
@@ -42,47 +38,43 @@ public class XercesSAXParserFactoryImpl extends SAXParserFactory {
     static {
         {
             final OrbeonParserConfiguration configuration = XercesSAXParser.makeConfig(false, true);
-            final Collection features = configuration.getRecognizedFeatures();
-            recognizedFeaturesNonValidatingXInclude = Collections.unmodifiableCollection(features);
+            final Collection recognizedFeatures = configuration.getRecognizedFeatures();
+            recognizedFeaturesNonValidatingXInclude = Collections.unmodifiableCollection(recognizedFeatures);
             defaultFeaturesNonValidatingXInclude = configuration.getFeatures();
-            // This was being done in XMLUtils.createSaxParserFactory before.  Maybe want to
-            // move it back if we decide to make this class more general purpose.
-            defaultFeaturesNonValidatingXInclude.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);
-            defaultFeaturesNonValidatingXInclude.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);
+            addDefaultFeatures(defaultFeaturesNonValidatingXInclude);
         }
         {
             final OrbeonParserConfiguration configuration = XercesSAXParser.makeConfig(false, false);
             final Collection features = configuration.getRecognizedFeatures();
             recognizedFeaturesNonValidatingNoXInclude = Collections.unmodifiableCollection(features);
             defaultFeaturesNonValidatingNoXInclude = configuration.getFeatures();
-            // This was being done in XMLUtils.createSaxParserFactory before.  Maybe want to
-            // move it back if we decide to make this class more general purpose.
-            defaultFeaturesNonValidatingNoXInclude.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);
-            defaultFeaturesNonValidatingNoXInclude.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);
+            addDefaultFeatures(defaultFeaturesNonValidatingNoXInclude);
         }
 
         {
             final OrbeonParserConfiguration configuration = XercesSAXParser.makeConfig(true, true);
             final Collection features = configuration.getRecognizedFeatures();
             recognizedFeaturesValidatingXInclude = Collections.unmodifiableCollection(features);
             defaultFeaturesValidatingXInclude = configuration.getFeatures();
-            // This was being done in XMLUtils.createSaxParserFactory before.  Maybe want to
-            // move it back if we decide to make this class more general purpose.
-            defaultFeaturesValidatingXInclude.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);
-            defaultFeaturesValidatingXInclude.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);
+            addDefaultFeatures(defaultFeaturesValidatingXInclude);
         }
         {
             final OrbeonParserConfiguration configuration = XercesSAXParser.makeConfig(true, false);
             final Collection features = configuration.getRecognizedFeatures();
             recognizedFeaturesValidatingNoXInclude = Collections.unmodifiableCollection(features);
             defaultFeaturesValidatingNoXInclude = configuration.getFeatures();
-            // This was being done in XMLUtils.createSaxParserFactory before.  Maybe want to
-            // move it back if we decide to make this class more general purpose.
-            defaultFeaturesValidatingNoXInclude.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);
-            defaultFeaturesValidatingNoXInclude.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);
+            addDefaultFeatures(defaultFeaturesValidatingNoXInclude);
         }
     }
 
+    private static void addDefaultFeatures(Map features) {
+        features.put("http://xml.org/sax/features/namespaces", Boolean.TRUE);
+        features.put("http://xml.org/sax/features/namespace-prefixes", Boolean.FALSE);
+        // For security purposes, disable external entities
+        features.put("http://xml.org/sax/features/external-general-entities", Boolean.FALSE);
+        features.put("http://xml.org/sax/features/external-parameter-entities", Boolean.FALSE);
+    }
+
     private final Hashtable features;
     private final boolean validating;
     private final boolean handleXInclude;
@@ -112,14 +104,13 @@ public void setFeature(final String key, final boolean val) throws SAXNotRecogni
         features.put(key, val ? Boolean.TRUE : Boolean.FALSE);
     }
 
-    public SAXParser newSAXParser() throws ParserConfigurationException {
+    public SAXParser newSAXParser() {
         final SAXParser ret;
         try {
             ret = new XercesJAXPSAXParser(this, features, validating, handleXInclude);
         } catch (final SAXException se) {
             // Translate to ParserConfigurationException
             throw new OXFException(se); // so we see a decent stack trace!
-//            throw new ParserConfigurationException(se.getMessage());
         }
         return ret;
     }
path: src/java/org/orbeon/oxf/xml/xerces/XercesSAXParserFactoryImpl.java