NIFI-9399 Apply Secure Processing to TransformXml XSLT

nifi-assembly/NOTICE

@@ -2108,7 +2108,7 @@ Mozilla Public License v2.0
 
 The following binary components are provided under the Mozilla Public License v2.0.  See project link for details.
 
-    (MPL 2.0) Saxon HE (net.sf.saxon:Saxon-HE:jar:9.6.0-5 - http://www.saxonica.com/)
+    (MPL 2.0) Saxon HE (net.sf.saxon:Saxon-HE:jar:10.6 - http://www.saxonica.com/)
     (MPL 2.0) Rhino (org.mozilla:rhino:jar:1.7R5 - https://developer.mozilla.org/en-US/docs/Mozilla/Projects/Rhino/Download_Rhino)
 
 *****************

nifi-nar-bundles/nifi-standard-bundle/nifi-standard-nar/src/main/resources/META-INF/NOTICE

@@ -272,7 +272,7 @@ Mozilla Public License v2.0
 
 The following binary components are provided under the Mozilla Public License v2.0.  See project link for details.
 
-    (MPL 2.0) Saxon HE (net.sf.saxon:Saxon-HE:jar:9.6.0-5 - http://www.saxonica.com/)
+    (MPL 2.0) Saxon HE (net.sf.saxon:Saxon-HE:jar:10.6 - http://www.saxonica.com/)
 
 *****************
 Public Domain

nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/test/java/org/apache/nifi/processors/standard/TestTransformXml.java

@@ -17,7 +17,6 @@
 package org.apache.nifi.processors.standard;
 
 import java.io.BufferedReader;
-import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStreamReader;
@@ -36,14 +35,14 @@
 public class TestTransformXml {
 
     @Test
-    public void testStylesheetNotFound() throws IOException {
+    public void testStylesheetNotFound() {
         final TestRunner controller = TestRunners.newTestRunner(TransformXml.class);
         controller.setProperty(TransformXml.XSLT_FILE_NAME, "/no/path/to/math.xsl");
         controller.assertNotValid();
     }
 
     @Test
-    public void testNonXmlContent() throws IOException {
+    public void testNonXmlContent() {
         final TestRunner runner = TestRunners.newTestRunner(new TransformXml());
         runner.setProperty(TransformXml.XSLT_FILE_NAME, "src/test/resources/TestTransformXml/math.xsl");
 
@@ -89,10 +88,10 @@ public void testTransformCsv() throws IOException {
         builder.append("<data>\n");
 
         try(BufferedReader reader = new BufferedReader(new InputStreamReader(
-                new FileInputStream(new File("src/test/resources/TestTransformXml/tokens.csv"))))){
+                new FileInputStream("src/test/resources/TestTransformXml/tokens.csv")))){
 
 
-            String line = null;
+            String line;
             while ((line = reader.readLine()) != null) {
                 builder.append(line).append("\n");
             }
@@ -144,7 +143,7 @@ public void testTransformNoCache() throws IOException {
     }
 
     @Test
-    public void testTransformBothControllerFileNotValid() throws IOException, InitializationException {
+    public void testTransformBothControllerFileNotValid() throws InitializationException {
         final TestRunner runner = TestRunners.newTestRunner(new TransformXml());
         runner.setProperty(TransformXml.XSLT_FILE_NAME, "src/test/resources/TestTransformXml/math.xsl");
 
@@ -159,14 +158,14 @@ public void testTransformBothControllerFileNotValid() throws IOException, Initia
     }
 
     @Test
-    public void testTransformNoneControllerFileNotValid() throws IOException, InitializationException {
+    public void testTransformNoneControllerFileNotValid() {
         final TestRunner runner = TestRunners.newTestRunner(new TransformXml());
         runner.setProperty(TransformXml.CACHE_SIZE, "0");
         runner.assertNotValid();
     }
 
     @Test
-    public void testTransformControllerNoKey() throws IOException, InitializationException {
+    public void testTransformControllerNoKey() throws InitializationException {
         final TestRunner runner = TestRunners.newTestRunner(new TransformXml());
 
         final SimpleKeyValueLookupService service = new SimpleKeyValueLookupService();
@@ -267,4 +266,35 @@ public void testTransformWithControllerNoCache() throws IOException, Initializat
         transformed.assertContentEquals(expectedContent);
     }
 
+    @Test
+    public void testTransformSecureProcessingEnabledXmlWithEntity() {
+        final TestRunner runner = TestRunners.newTestRunner(new TransformXml());
+        runner.setProperty(TransformXml.XSLT_FILE_NAME, "src/test/resources/TestTransformXml/doc-node.xsl");
+        runner.setProperty(TransformXml.INDENT_OUTPUT, Boolean.FALSE.toString());
+
+        final String input = "<!DOCTYPE doc [<!ENTITY uri SYSTEM \"http://127.0.0.1\" >]><doc>&uri;</doc>";
+        runner.enqueue(input);
+        runner.run();
+
+        runner.assertAllFlowFilesTransferred(TransformXml.REL_SUCCESS);
+        final MockFlowFile transformed = runner.getFlowFilesForRelationship(TransformXml.REL_SUCCESS).get(0);
+
+        final String expected = "<?xml version=\"1.0\" encoding=\"UTF-8\"?><doc xmlns:xs=\"http://www.w3.org/2001/XMLSchema\"/>";
+        transformed.assertContentEquals(expected);
+    }
+
+    @Test
+    public void testTransformSecureProcessingEnabledXslWithEntity() throws IOException {
+        final TestRunner runner = TestRunners.newTestRunner(new TransformXml());
+        runner.setProperty(TransformXml.XSLT_FILE_NAME, "src/test/resources/TestTransformXml/doctype-entity-file-uri.xsl");
+        runner.setProperty(TransformXml.INDENT_OUTPUT, Boolean.FALSE.toString());
+
+        runner.enqueue(Paths.get("src/test/resources/TestTransformXml/doctype-entity-file-uri.xsl"));
+        runner.run();
+
+        runner.assertAllFlowFilesTransferred(TransformXml.REL_SUCCESS);
+        final MockFlowFile transformed = runner.getFlowFilesForRelationship(TransformXml.REL_SUCCESS).get(0);
+
+        transformed.assertContentEquals("<?xml version=\"1.0\" encoding=\"UTF-8\"?>");
+    }
 }

nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/test/resources/TestTransformXml/doc-node.xsl

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+      http://www.apache.org/licenses/LICENSE-2.0
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+<xsl:stylesheet version="2.0"
+                xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+                xmlns:xs="http://www.w3.org/2001/XMLSchema">
+    <xsl:template match="doc">
+        <doc><xsl:value-of select="node()"/></doc>
+    </xsl:template>
+</xsl:stylesheet>

nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/test/resources/TestTransformXml/doctype-entity-file-uri.xsl

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+      http://www.apache.org/licenses/LICENSE-2.0
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+<!DOCTYPE stylesheet [<!ENTITY % uri SYSTEM 'http://127.0.0.1'> %uri;]>
+<xsl:stylesheet version="2.0"
+                xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+                xmlns:xs="http://www.w3.org/2001/XMLSchema"/>

nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/test/resources/TestTransformXml/math.html

@@ -1,4 +1,4 @@
-<HTML xmlns:xs="http://www.w3.org/2001/XMLSchema">
+<!DOCTYPE HTML><HTML xmlns:xs="http://www.w3.org/2001/XMLSchema">
    <H1>Test for mod</H1>
    <HR>
    <P>Should say "1": 1</P>

nifi-nar-bundles/nifi-standard-bundle/pom.xml

@@ -233,7 +233,7 @@
             <dependency>
                 <groupId>net.sf.saxon</groupId>
                 <artifactId>Saxon-HE</artifactId>
-                <version>9.6.0-5</version>
+                <version>10.6</version>
             </dependency>
             <dependency>
                 <groupId>joda-time</groupId>