From 5d408e584dd5c8ba3a3f44cfae3c324b3e0bffe0 Mon Sep 17 00:00:00 2001 From: Adam Samalik Date: Thu, 29 Jun 2023 11:43:14 +0200 Subject: [PATCH] re-import sources as agreed with the maintainer --- .gitignore | 10 +++ generate-tarball.sh | 0 serializer-2.7.2.pom | 39 --------- sources | 3 + xalan-2.7.2.pom | 41 ---------- xalan-j2-CVE-2014-0107.patch | 148 +++++++++++++++++++++++++++++++++++ xsltc-2.7.2.pom | 13 --- 7 files changed, 161 insertions(+), 93 deletions(-) mode change 100755 => 100644 generate-tarball.sh delete mode 100644 serializer-2.7.2.pom delete mode 100644 xalan-2.7.2.pom create mode 100644 xalan-j2-CVE-2014-0107.patch delete mode 100644 xsltc-2.7.2.pom diff --git a/.gitignore b/.gitignore index 1c5ec1b..1806014 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,11 @@ +xalan-j2-notarget.patch +xalan-j_2_7_0-src-RHsemiCLEAN.tar.gz +xalan-j_2_7_1-src.tar.gz +/serializer-2.7.1.pom +/xalan-2.7.1.pom +/xsltc-2.7.1.pom +/xalan-j2-2.7.1.tar.gz /xalan-j2-2.7.2.tar.gz +/xalan-2.7.2.pom +/serializer-2.7.2.pom +/xsltc-2.7.2.pom diff --git a/generate-tarball.sh b/generate-tarball.sh old mode 100755 new mode 100644 diff --git a/serializer-2.7.2.pom b/serializer-2.7.2.pom deleted file mode 100644 index 677fc1a..0000000 --- a/serializer-2.7.2.pom +++ /dev/null @@ -1,39 +0,0 @@ - - - - 4.0.0 - - org.apache - apache - 4 - - - xalan - serializer - 2.7.2 - - Xalan Java Serializer - - Serializer to write out XML, HTML etc. as a stream of characters from an input DOM or from input - SAX events. - - http://xml.apache.org/xalan-j/ - - - - xml-apis - xml-apis - 1.3.04 - - - xerces - xercesImpl - 2.9.1 - true - - - - diff --git a/sources b/sources index ecb5eb0..9e100e3 100644 --- a/sources +++ b/sources @@ -1 +1,4 @@ SHA512 (xalan-j2-2.7.2.tar.gz) = d30cc8179eb98704f8bbab80b6462565b177bc9cee99be042f0cad0d34924446574ae849f735fcc0cbbbcd81963c1b1bc0f76d8f981109ae168b21cb057c0eef +SHA512 (xalan-2.7.2.pom) = 4b95e3eb3a2ab262c9a27040a5214cfb8c49c36ece8e71a933074eb063205ef96deff351f017b034c9c97d43d77b020482aade7bc01e1245d8ee10a51269c5ce +SHA512 (serializer-2.7.2.pom) = 1a20cd7008ab876f9605a67515d558b26b9be009c4f49cb27ddf5aa715b5d164c476c236b6d6edf39e81538dfb1516271c3859af8e73f8cdbeee24efb45e9a44 +SHA512 (xsltc-2.7.2.pom) = 89c5c2cd358c32a9b8073869abdcb1df21a95c21a1a099c1b91f25ac3de7fdf9893977cb227efa4dad1de29773aaaef155155d1ec8648aae3c2e512154c200ef diff --git a/xalan-2.7.2.pom b/xalan-2.7.2.pom deleted file mode 100644 index 758958d..0000000 --- a/xalan-2.7.2.pom +++ /dev/null @@ -1,41 +0,0 @@ - - - - 4.0.0 - - org.apache - apache - 4 - - - xalan - xalan - 2.7.2 - - Xalan Java - - Xalan-Java is an XSLT processor for transforming XML documents into HTML, - text, or other XML document types. It implements XSL Transformations (XSLT) - Version 1.0 and XML Path Language (XPath) Version 1.0 and can be used from - the command line, in an applet or a servlet, or as a module in other program. - - http://xml.apache.org/xalan-j/ - - - - xalan - serializer - 2.7.2 - - - xerces - xercesImpl - 2.9.1 - true - - - - \ No newline at end of file diff --git a/xalan-j2-CVE-2014-0107.patch b/xalan-j2-CVE-2014-0107.patch new file mode 100644 index 0000000..3358f60 --- /dev/null +++ b/xalan-j2-CVE-2014-0107.patch @@ -0,0 +1,148 @@ +diff --git a/src/org/apache/xalan/processor/TransformerFactoryImpl.java b/src/org/apache/xalan/processor/TransformerFactoryImpl.java +index 1298943..96a5e58 100644 +--- a/src/org/apache/xalan/processor/TransformerFactoryImpl.java ++++ b/src/org/apache/xalan/processor/TransformerFactoryImpl.java +@@ -335,6 +335,10 @@ public class TransformerFactoryImpl extends SAXTransformerFactory + reader = XMLReaderFactory.createXMLReader(); + } + ++ if(m_isSecureProcessing) ++ { ++ reader.setFeature("http://xml.org/sax/features/external-general-entities",false); ++ } + // Need to set options! + reader.setContentHandler(handler); + reader.parse(isource); +diff --git a/src/org/apache/xalan/processor/XSLTElementProcessor.java b/src/org/apache/xalan/processor/XSLTElementProcessor.java +index b946743..17b7395 100644 +--- a/src/org/apache/xalan/processor/XSLTElementProcessor.java ++++ b/src/org/apache/xalan/processor/XSLTElementProcessor.java +@@ -338,17 +338,31 @@ public class XSLTElementProcessor extends ElemTemplateElement + } + else + { +- // Can we switch the order here: +- +- boolean success = attrDef.setAttrValue(handler, attrUri, attrLocalName, +- attributes.getQName(i), attributes.getValue(i), +- target); +- +- // Now we only add the element if it passed a validation check +- if (success) +- processedDefs.add(attrDef); +- else +- errorDefs.add(attrDef); ++ //handle secure processing ++ if(handler.getStylesheetProcessor()==null) ++ System.out.println("stylesheet processor null"); ++ if(attrDef.getName().compareTo("*")==0 && handler.getStylesheetProcessor().isSecureProcessing()) ++ { ++ //foreign attributes are not allowed in secure processing mode ++ // Then barf, because this element does not allow this attribute. ++ handler.error(XSLTErrorResources.ER_ATTR_NOT_ALLOWED, new Object[]{attributes.getQName(i), rawName}, null);//"\""+attributes.getQName(i)+"\"" ++ //+ " attribute is not allowed on the " + rawName ++ // + " element!", null); ++ } ++ else ++ { ++ ++ ++ boolean success = attrDef.setAttrValue(handler, attrUri, attrLocalName, ++ attributes.getQName(i), attributes.getValue(i), ++ target); ++ ++ // Now we only add the element if it passed a validation check ++ if (success) ++ processedDefs.add(attrDef); ++ else ++ errorDefs.add(attrDef); ++ } + } + } + +diff --git a/src/org/apache/xalan/transformer/TransformerImpl.java b/src/org/apache/xalan/transformer/TransformerImpl.java +index dd0d4d9..0906d24 100644 +--- a/src/org/apache/xalan/transformer/TransformerImpl.java ++++ b/src/org/apache/xalan/transformer/TransformerImpl.java +@@ -438,7 +438,9 @@ public class TransformerImpl extends Transformer + try + { + if (sroot.getExtensions() != null) +- m_extensionsTable = new ExtensionsTable(sroot); ++ //only load extensions if secureProcessing is disabled ++ if(!sroot.isSecureProcessing()) ++ m_extensionsTable = new ExtensionsTable(sroot); + } + catch (javax.xml.transform.TransformerException te) + {te.printStackTrace();} +diff --git a/src/org/apache/xpath/functions/FuncSystemProperty.java b/src/org/apache/xpath/functions/FuncSystemProperty.java +index 4bea356..78ac980 100644 +--- a/src/org/apache/xpath/functions/FuncSystemProperty.java ++++ b/src/org/apache/xpath/functions/FuncSystemProperty.java +@@ -58,7 +58,7 @@ public class FuncSystemProperty extends FunctionOneArg + + String fullName = m_arg0.execute(xctxt).str(); + int indexOfNSSep = fullName.indexOf(':'); +- String result; ++ String result = null; + String propName = ""; + + // List of properties where the name of the +@@ -98,14 +98,20 @@ public class FuncSystemProperty extends FunctionOneArg + + try + { +- result = System.getProperty(propName); +- +- if (null == result) +- { +- +- // result = System.getenv(propName); +- return XString.EMPTYSTRING; +- } ++ //if secure procession is enabled only handle required properties do not not map any valid system property ++ if(!xctxt.isSecureProcessing()) ++ { ++ result = System.getProperty(propName); ++ } ++ else ++ { ++ warn(xctxt, XPATHErrorResources.WG_SECURITY_EXCEPTION, ++ new Object[]{ fullName }); //"SecurityException when trying to access XSL system property: "+fullName); ++ } ++ if (null == result) ++ { ++ return XString.EMPTYSTRING; ++ } + } + catch (SecurityException se) + { +@@ -120,14 +126,20 @@ public class FuncSystemProperty extends FunctionOneArg + { + try + { +- result = System.getProperty(fullName); +- +- if (null == result) +- { +- +- // result = System.getenv(fullName); +- return XString.EMPTYSTRING; +- } ++ //if secure procession is enabled only handle required properties do not not map any valid system property ++ if(!xctxt.isSecureProcessing()) ++ { ++ result = System.getProperty(fullName); ++ } ++ else ++ { ++ warn(xctxt, XPATHErrorResources.WG_SECURITY_EXCEPTION, ++ new Object[]{ fullName }); //"SecurityException when trying to access XSL system property: "+fullName); ++ } ++ if (null == result) ++ { ++ return XString.EMPTYSTRING; ++ } + } + catch (SecurityException se) + { diff --git a/xsltc-2.7.2.pom b/xsltc-2.7.2.pom deleted file mode 100644 index ea34be4..0000000 --- a/xsltc-2.7.2.pom +++ /dev/null @@ -1,13 +0,0 @@ - - 4.0.0 - xalan - xsltc - 2.7.2 - - - xalan - xalan - 2.7.2 - - -