[java-shib-shared] branch main updated: JSSH-20 - Spring is still falling through to remote access of XML files
Scott Cantor
cantor.2 at osu.edu
Tue Apr 18 17:24:26 UTC 2023
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-shib-shared.
View the commit online:
http://git.shibboleth.net/view/?p=java-shib-shared.git;a=commit;h=35def9f41566afaca66577b79cf75a0a5cb7de76
The following commit(s) were added to refs/heads/main by this push:
new 35def9f4 JSSH-20 - Spring is still falling through to remote access of XML files
35def9f4 is described below
commit 35def9f41566afaca66577b79cf75a0a5cb7de76
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Apr 18 13:24:23 2023 -0400
JSSH-20 - Spring is still falling through to remote access of XML files
https://shibboleth.atlassian.net/browse/JSSH-20
Alter fix to take advantage of Spring API change.
---
.../custom/LocalOnlyResourceEntityResolver.java | 90 +++-------------------
.../shared/spring/custom/CanarySchemaTest.java | 4 +-
2 files changed, 13 insertions(+), 81 deletions(-)
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/LocalOnlyResourceEntityResolver.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/LocalOnlyResourceEntityResolver.java
index d360f689..ce4f8e11 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/LocalOnlyResourceEntityResolver.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/LocalOnlyResourceEntityResolver.java
@@ -17,39 +17,27 @@
package net.shibboleth.shared.spring.custom;
-import java.io.File;
-import java.io.IOException;
-import java.net.URLDecoder;
-import java.nio.charset.StandardCharsets;
-
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.xml.sax.InputSource;
-import org.xml.sax.SAXException;
import net.shibboleth.shared.primitive.LoggerFactory;
import org.slf4j.Logger;
-
-import org.springframework.beans.factory.xml.DelegatingEntityResolver;
+import org.springframework.beans.factory.BeanDefinitionStoreException;
import org.springframework.beans.factory.xml.ResourceEntityResolver;
-import org.springframework.core.io.Resource;
import org.springframework.core.io.ResourceLoader;
-import org.springframework.util.ResourceUtils;
/**
* Modified copy of Spring's existing {@link ResourceEntityResolver} class that
* elides the fall-through logic allowing for http(s) resolution of entities.
*/
-public class LocalOnlyResourceEntityResolver extends DelegatingEntityResolver {
+public class LocalOnlyResourceEntityResolver extends ResourceEntityResolver {
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(LocalOnlyResourceEntityResolver.class);
- /** Resource loader. */
- @Nonnull private final ResourceLoader resourceLoader;
-
/**
* Create a ResourceEntityResolver for the specified ResourceLoader
* (usually, an ApplicationContext).
@@ -58,74 +46,18 @@ public class LocalOnlyResourceEntityResolver extends DelegatingEntityResolver {
* to load XML entity includes with
*/
public LocalOnlyResourceEntityResolver(@Nonnull final ResourceLoader loader) {
- super(loader.getClassLoader());
- resourceLoader = loader;
+ super(loader);
}
-
+
/** {@inheritDoc} */
@Override
- @Nullable public InputSource resolveEntity(@Nullable final String publicId, @Nullable final String systemId)
- throws SAXException, IOException {
-
- InputSource source = super.resolveEntity(publicId, systemId);
-
- if (source == null && systemId != null) {
- String resourcePath = null;
- try {
- final String decodedSystemId = URLDecoder.decode(systemId, StandardCharsets.UTF_8);
- assert decodedSystemId != null;
- final String givenUrl = ResourceUtils.toURL(decodedSystemId).toString();
- final String systemRootUrl = new File("").toURI().toURL().toString();
- // Try relative to resource base if currently in system root.
- if (givenUrl.startsWith(systemRootUrl)) {
- resourcePath = givenUrl.substring(systemRootUrl.length());
- }
- } catch (final Exception ex) {
- // Typically a MalformedURLException or AccessControlException.
- log.debug("Could not resolve XML entity [{}] against system root URL", systemId, ex);
- // No URL (or no resolvable URL) -> try relative to resource base.
- resourcePath = systemId;
- }
-
- if (resourcePath != null) {
- log.trace("Trying to locate XML entity [{}] as resource [{}]", systemId, resourcePath);
- final Resource resource = this.resourceLoader.getResource(resourcePath);
- source = new InputSource(resource.getInputStream());
- source.setPublicId(publicId);
- source.setSystemId(systemId);
- log.debug("Found XML entity [{}]:", systemId, resource);
- } else if (systemId.endsWith(DTD_SUFFIX) || systemId.endsWith(XSD_SUFFIX)) {
- // External dtd/xsd lookup via https even for canonical http declaration
- String url = systemId;
- if (url.startsWith("http:")) {
- url = "https:" + url.substring(5);
- }
-
- log.warn("Blocking attempted remote resolution of [{}]", systemId);
- // If we don't throw here, Java's broken parser just blindly proceeds with its own
- // internal entity resolution.
- throw new IOException("Blocked atttempted remote resolution");
-
- // This is being elided.
-
- /*
- try {
- source = new InputSource(ResourceUtils.toURL(url).openStream());
- source.setPublicId(publicId);
- source.setSystemId(systemId);
- }
- catch (IOException ex) {
- if (logger.isDebugEnabled()) {
- logger.debug("Could not resolve XML entity [" + systemId + "] through URL [" + url + "]", ex);
- }
- // Fall back to the parser's default behavior.
- source = null;
- }
- */
- }
- }
-
- return source;
+ @Nullable protected InputSource resolveSchemaEntity(@Nullable final String publicId,
+ @Nonnull final String systemId) {
+
+ log.warn("Blocking attempted remote resolution of [{}]", systemId);
+ // If we don't throw here, Java's broken parser just blindly proceeds with its own
+ // internal entity resolution.
+ throw new BeanDefinitionStoreException("Blocked atttempted remote resolution");
}
}
\ No newline at end of file
diff --git a/shib-spring/src/test/java/net/shibboleth/shared/spring/custom/CanarySchemaTest.java b/shib-spring/src/test/java/net/shibboleth/shared/spring/custom/CanarySchemaTest.java
index 7bd291a9..91348f2d 100644
--- a/shib-spring/src/test/java/net/shibboleth/shared/spring/custom/CanarySchemaTest.java
+++ b/shib-spring/src/test/java/net/shibboleth/shared/spring/custom/CanarySchemaTest.java
@@ -17,7 +17,7 @@
package net.shibboleth.shared.spring.custom;
-import org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException;
+import org.springframework.beans.factory.BeanDefinitionStoreException;
import org.springframework.context.support.GenericApplicationContext;
import org.springframework.core.io.ClassPathResource;
import org.testng.annotations.Test;
@@ -27,7 +27,7 @@ import org.testng.annotations.Test;
*/
public class CanarySchemaTest {
- @Test(expectedExceptions=XmlBeanDefinitionStoreException.class)
+ @Test(expectedExceptions=BeanDefinitionStoreException.class)
void Test() {
final GenericApplicationContext context = new GenericApplicationContext();
context.setDisplayName("ApplicationContext for Canary");
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list