[XALANJ-2435] Use of secure processing feature should disable some output properties

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.7.1
• Fix Version/s: 2.7.2
• Assignee: Gary D. Gregory
• Reporter: Steve Jones
• Created: 01/Mar/08 00:53
• Updated: 15/Feb/16 09:42
• Resolved: 25/Mar/14 21:06

Description

When using the FEATURE_SECURE_PROCESSING ("http://javax.xml.XMLConstants/feature/secure-processing") on a TransformerFactory it seems appropriate that the output properties:

{http://xml.apache.org/xalan}

content-handler

{http://xml.apache.org/xalan}

entities

{http://xml.apache.org/xslt}

content-handler

{http://xml.apache.org/xslt}

entities

should be ignored (see http://xml.apache.org/xalan-j/usagepatterns.html#outputprops)

These properties can be used to load an arbitrary class or access an arbitrary URL/resource so are problematic when secure processing is desired.

<xsl:output xalan:content-handler="org.example.BadClass" ...
<xsl:output xalan:entities="http://example.org/reallyLargeFile.bin" ...

These features could be used to load a class that had undesirable side-effects or to load a large file and exhaust memory, etc.

Issue Links

• is related to: XALANJ-2591 Transform XSLT using Xalan into XHTML fails with secure processing feature when using attributes