Uploaded image for project: 'Red Hat Fuse'
  1. Red Hat Fuse
  2. ENTESB-19738

Unable to configure security attributes in camel saxon transformer

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Won't Do
    • Icon: Major Major
    • fuse-7.11.1-GA
    • fuse-7.11-GA
    • Camel
    • None

      OWASP recommendations for CVE-2017-7465 recommend the following

      TransformerFactory tf = TransformerFactory.newInstance();
tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");

      If using camel-saxon in a spring-boot application, attempting to set those values results in:

      Caused by: java.lang.IllegalArgumentException: Unknown configuration property http://javax.xml.XMLConstants/property/accessExternalDTD

      What you can do, is set the following

      sf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

       

      But it's not clear that this actually addresses the CVE, and it causes security scanners to still flag it as a vulnerability.  This appears to be an issue in EAP as well.  This may have been addressed in Saxon 10.3 if I'm reading this bug correctly; Fuse 7.11 is using version 9.8.

      $ mvn dependency:tree | grep saxon
[INFO] +- org.apache.camel:camel-saxon:jar:2.23.2.fuse-7_11_0-00037-redhat-00001:compile
[INFO] |  +- net.sf.saxon:Saxon-HE:jar:9.8.0-14:compile 

       

       

              ggrzybek Grzegorz Grzybek
              rhn-support-shiggs Stephen Higgs
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                Resolved: