Compare commits
No commits in common. "c8-stream-201902" and "stream-javapackages-tools-201902-rhel-8.9.0" have entirely different histories.
c8-stream-
...
stream-jav
|
|
@ -1 +1,11 @@
|
|||
SOURCES/xalan-j2-2.7.2.tar.gz
|
||||
xalan-j2-notarget.patch
|
||||
xalan-j_2_7_0-src-RHsemiCLEAN.tar.gz
|
||||
xalan-j_2_7_1-src.tar.gz
|
||||
/serializer-2.7.1.pom
|
||||
/xalan-2.7.1.pom
|
||||
/xsltc-2.7.1.pom
|
||||
/xalan-j2-2.7.1.tar.gz
|
||||
/xalan-j2-2.7.2.tar.gz
|
||||
/xalan-2.7.2.pom
|
||||
/serializer-2.7.2.pom
|
||||
/xsltc-2.7.2.pom
|
||||
|
|
|
|||
|
|
@ -1 +1,4 @@
|
|||
678a79a205b08c900722406f030e95fb7fa7f1c8 SOURCES/xalan-j2-2.7.2.tar.gz
|
||||
678a79a205b08c900722406f030e95fb7fa7f1c8 xalan-j2-2.7.2.tar.gz
|
||||
97d232191877cf441ac5b72d2cb05a3580ba9e7e xalan-2.7.2.pom
|
||||
454c86397279a646a38afad68bd8f2f465de7bfe serializer-2.7.2.pom
|
||||
e0fcfaac70d12dc0d48f96417fa59199bb6061a0 xsltc-2.7.2.pom
|
||||
|
|
|
|||
|
|
@ -1,39 +0,0 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<project
|
||||
xmlns="http://maven.apache.org/POM/4.0.0"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
<parent>
|
||||
<groupId>org.apache</groupId>
|
||||
<artifactId>apache</artifactId>
|
||||
<version>4</version>
|
||||
</parent>
|
||||
|
||||
<groupId>xalan</groupId>
|
||||
<artifactId>serializer</artifactId>
|
||||
<version>2.7.2</version>
|
||||
|
||||
<name>Xalan Java Serializer</name>
|
||||
<description>
|
||||
Serializer to write out XML, HTML etc. as a stream of characters from an input DOM or from input
|
||||
SAX events.
|
||||
</description>
|
||||
<url>http://xml.apache.org/xalan-j/</url>
|
||||
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>xml-apis</groupId>
|
||||
<artifactId>xml-apis</artifactId>
|
||||
<version>1.3.04</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>xerces</groupId>
|
||||
<artifactId>xercesImpl</artifactId>
|
||||
<version>2.9.1</version>
|
||||
<optional>true</optional>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
|
||||
</project>
|
||||
|
|
@ -1,41 +0,0 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<project
|
||||
xmlns="http://maven.apache.org/POM/4.0.0"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
<parent>
|
||||
<groupId>org.apache</groupId>
|
||||
<artifactId>apache</artifactId>
|
||||
<version>4</version>
|
||||
</parent>
|
||||
|
||||
<groupId>xalan</groupId>
|
||||
<artifactId>xalan</artifactId>
|
||||
<version>2.7.2</version>
|
||||
|
||||
<name>Xalan Java</name>
|
||||
<description>
|
||||
Xalan-Java is an XSLT processor for transforming XML documents into HTML,
|
||||
text, or other XML document types. It implements XSL Transformations (XSLT)
|
||||
Version 1.0 and XML Path Language (XPath) Version 1.0 and can be used from
|
||||
the command line, in an applet or a servlet, or as a module in other program.
|
||||
</description>
|
||||
<url>http://xml.apache.org/xalan-j/</url>
|
||||
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>xalan</groupId>
|
||||
<artifactId>serializer</artifactId>
|
||||
<version>2.7.2</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>xerces</groupId>
|
||||
<artifactId>xercesImpl</artifactId>
|
||||
<version>2.9.1</version>
|
||||
<optional>true</optional>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
|
||||
</project>
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
<project>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
<groupId>xalan</groupId>
|
||||
<artifactId>xsltc</artifactId>
|
||||
<version>2.7.2</version>
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>xalan</groupId>
|
||||
<artifactId>xalan</artifactId>
|
||||
<version>2.7.2</version>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
</project>
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
SHA512 (xalan-j2-2.7.2.tar.gz) = d30cc8179eb98704f8bbab80b6462565b177bc9cee99be042f0cad0d34924446574ae849f735fcc0cbbbcd81963c1b1bc0f76d8f981109ae168b21cb057c0eef
|
||||
SHA512 (xalan-2.7.2.pom) = 4b95e3eb3a2ab262c9a27040a5214cfb8c49c36ece8e71a933074eb063205ef96deff351f017b034c9c97d43d77b020482aade7bc01e1245d8ee10a51269c5ce
|
||||
SHA512 (serializer-2.7.2.pom) = 1a20cd7008ab876f9605a67515d558b26b9be009c4f49cb27ddf5aa715b5d164c476c236b6d6edf39e81538dfb1516271c3859af8e73f8cdbeee24efb45e9a44
|
||||
SHA512 (xsltc-2.7.2.pom) = 89c5c2cd358c32a9b8073869abdcb1df21a95c21a1a099c1b91f25ac3de7fdf9893977cb227efa4dad1de29773aaaef155155d1ec8648aae3c2e512154c200ef
|
||||
|
|
@ -0,0 +1,148 @@
|
|||
diff --git a/src/org/apache/xalan/processor/TransformerFactoryImpl.java b/src/org/apache/xalan/processor/TransformerFactoryImpl.java
|
||||
index 1298943..96a5e58 100644
|
||||
--- a/src/org/apache/xalan/processor/TransformerFactoryImpl.java
|
||||
+++ b/src/org/apache/xalan/processor/TransformerFactoryImpl.java
|
||||
@@ -335,6 +335,10 @@ public class TransformerFactoryImpl extends SAXTransformerFactory
|
||||
reader = XMLReaderFactory.createXMLReader();
|
||||
}
|
||||
|
||||
+ if(m_isSecureProcessing)
|
||||
+ {
|
||||
+ reader.setFeature("http://xml.org/sax/features/external-general-entities",false);
|
||||
+ }
|
||||
// Need to set options!
|
||||
reader.setContentHandler(handler);
|
||||
reader.parse(isource);
|
||||
diff --git a/src/org/apache/xalan/processor/XSLTElementProcessor.java b/src/org/apache/xalan/processor/XSLTElementProcessor.java
|
||||
index b946743..17b7395 100644
|
||||
--- a/src/org/apache/xalan/processor/XSLTElementProcessor.java
|
||||
+++ b/src/org/apache/xalan/processor/XSLTElementProcessor.java
|
||||
@@ -338,17 +338,31 @@ public class XSLTElementProcessor extends ElemTemplateElement
|
||||
}
|
||||
else
|
||||
{
|
||||
- // Can we switch the order here:
|
||||
-
|
||||
- boolean success = attrDef.setAttrValue(handler, attrUri, attrLocalName,
|
||||
- attributes.getQName(i), attributes.getValue(i),
|
||||
- target);
|
||||
-
|
||||
- // Now we only add the element if it passed a validation check
|
||||
- if (success)
|
||||
- processedDefs.add(attrDef);
|
||||
- else
|
||||
- errorDefs.add(attrDef);
|
||||
+ //handle secure processing
|
||||
+ if(handler.getStylesheetProcessor()==null)
|
||||
+ System.out.println("stylesheet processor null");
|
||||
+ if(attrDef.getName().compareTo("*")==0 && handler.getStylesheetProcessor().isSecureProcessing())
|
||||
+ {
|
||||
+ //foreign attributes are not allowed in secure processing mode
|
||||
+ // Then barf, because this element does not allow this attribute.
|
||||
+ handler.error(XSLTErrorResources.ER_ATTR_NOT_ALLOWED, new Object[]{attributes.getQName(i), rawName}, null);//"\""+attributes.getQName(i)+"\""
|
||||
+ //+ " attribute is not allowed on the " + rawName
|
||||
+ // + " element!", null);
|
||||
+ }
|
||||
+ else
|
||||
+ {
|
||||
+
|
||||
+
|
||||
+ boolean success = attrDef.setAttrValue(handler, attrUri, attrLocalName,
|
||||
+ attributes.getQName(i), attributes.getValue(i),
|
||||
+ target);
|
||||
+
|
||||
+ // Now we only add the element if it passed a validation check
|
||||
+ if (success)
|
||||
+ processedDefs.add(attrDef);
|
||||
+ else
|
||||
+ errorDefs.add(attrDef);
|
||||
+ }
|
||||
}
|
||||
}
|
||||
|
||||
diff --git a/src/org/apache/xalan/transformer/TransformerImpl.java b/src/org/apache/xalan/transformer/TransformerImpl.java
|
||||
index dd0d4d9..0906d24 100644
|
||||
--- a/src/org/apache/xalan/transformer/TransformerImpl.java
|
||||
+++ b/src/org/apache/xalan/transformer/TransformerImpl.java
|
||||
@@ -438,7 +438,9 @@ public class TransformerImpl extends Transformer
|
||||
try
|
||||
{
|
||||
if (sroot.getExtensions() != null)
|
||||
- m_extensionsTable = new ExtensionsTable(sroot);
|
||||
+ //only load extensions if secureProcessing is disabled
|
||||
+ if(!sroot.isSecureProcessing())
|
||||
+ m_extensionsTable = new ExtensionsTable(sroot);
|
||||
}
|
||||
catch (javax.xml.transform.TransformerException te)
|
||||
{te.printStackTrace();}
|
||||
diff --git a/src/org/apache/xpath/functions/FuncSystemProperty.java b/src/org/apache/xpath/functions/FuncSystemProperty.java
|
||||
index 4bea356..78ac980 100644
|
||||
--- a/src/org/apache/xpath/functions/FuncSystemProperty.java
|
||||
+++ b/src/org/apache/xpath/functions/FuncSystemProperty.java
|
||||
@@ -58,7 +58,7 @@ public class FuncSystemProperty extends FunctionOneArg
|
||||
|
||||
String fullName = m_arg0.execute(xctxt).str();
|
||||
int indexOfNSSep = fullName.indexOf(':');
|
||||
- String result;
|
||||
+ String result = null;
|
||||
String propName = "";
|
||||
|
||||
// List of properties where the name of the
|
||||
@@ -98,14 +98,20 @@ public class FuncSystemProperty extends FunctionOneArg
|
||||
|
||||
try
|
||||
{
|
||||
- result = System.getProperty(propName);
|
||||
-
|
||||
- if (null == result)
|
||||
- {
|
||||
-
|
||||
- // result = System.getenv(propName);
|
||||
- return XString.EMPTYSTRING;
|
||||
- }
|
||||
+ //if secure procession is enabled only handle required properties do not not map any valid system property
|
||||
+ if(!xctxt.isSecureProcessing())
|
||||
+ {
|
||||
+ result = System.getProperty(propName);
|
||||
+ }
|
||||
+ else
|
||||
+ {
|
||||
+ warn(xctxt, XPATHErrorResources.WG_SECURITY_EXCEPTION,
|
||||
+ new Object[]{ fullName }); //"SecurityException when trying to access XSL system property: "+fullName);
|
||||
+ }
|
||||
+ if (null == result)
|
||||
+ {
|
||||
+ return XString.EMPTYSTRING;
|
||||
+ }
|
||||
}
|
||||
catch (SecurityException se)
|
||||
{
|
||||
@@ -120,14 +126,20 @@ public class FuncSystemProperty extends FunctionOneArg
|
||||
{
|
||||
try
|
||||
{
|
||||
- result = System.getProperty(fullName);
|
||||
-
|
||||
- if (null == result)
|
||||
- {
|
||||
-
|
||||
- // result = System.getenv(fullName);
|
||||
- return XString.EMPTYSTRING;
|
||||
- }
|
||||
+ //if secure procession is enabled only handle required properties do not not map any valid system property
|
||||
+ if(!xctxt.isSecureProcessing())
|
||||
+ {
|
||||
+ result = System.getProperty(fullName);
|
||||
+ }
|
||||
+ else
|
||||
+ {
|
||||
+ warn(xctxt, XPATHErrorResources.WG_SECURITY_EXCEPTION,
|
||||
+ new Object[]{ fullName }); //"SecurityException when trying to access XSL system property: "+fullName);
|
||||
+ }
|
||||
+ if (null == result)
|
||||
+ {
|
||||
+ return XString.EMPTYSTRING;
|
||||
+ }
|
||||
}
|
||||
catch (SecurityException se)
|
||||
{
|
||||
Loading…
Reference in New Issue