Skip to content

Commit 441edf3

Browse files
yadvryadvr
authored
utils: use safer parsing utility across codebase (#6562)
This addresses SonarQube/SonarCloud quality checks to use safer xml parser to resist potential XXE attacks. https://sonarcloud.io/organizations/apache/rules?open=java%3AS2755&rule_key=java%3AS2755 Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
1 parent c4c4c71 commit 441edf3

21 files changed

Lines changed: 216 additions & 121 deletions

File tree

‎api/src/main/java/com/cloud/agent/api/storage/OVFHelper.java‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -35,19 +35,10 @@
3535
import javax.xml.transform.dom.DOMSource;
3636
import javax.xml.transform.stream.StreamResult;
3737

38-
import com.cloud.agent.api.to.deployasis.OVFConfigurationTO;
39-
import com.cloud.agent.api.to.deployasis.OVFEulaSectionTO;
40-
import com.cloud.agent.api.to.deployasis.OVFPropertyTO;
41-
import com.cloud.agent.api.to.deployasis.OVFVirtualHardwareItemTO;
42-
import com.cloud.agent.api.to.deployasis.OVFVirtualHardwareSectionTO;
43-
import com.cloud.configuration.Resource.ResourceType;
44-
import com.cloud.exception.InternalErrorException;
45-
import com.cloud.utils.Pair;
46-
import com.cloud.utils.compression.CompressionUtil;
47-
import com.cloud.agent.api.to.deployasis.OVFNetworkTO;
38+
import org.apache.cloudstack.utils.security.ParserUtils;
4839
import org.apache.commons.collections.CollectionUtils;
49-
import org.apache.commons.lang3.StringUtils;
5040
import org.apache.commons.lang.math.NumberUtils;
41+
import org.apache.commons.lang3.StringUtils;
5142
import org.apache.log4j.Logger;
5243
import org.w3c.dom.Document;
5344
import org.w3c.dom.Element;
@@ -56,10 +47,20 @@
5647
import org.w3c.dom.traversal.DocumentTraversal;
5748
import org.w3c.dom.traversal.NodeFilter;
5849
import org.w3c.dom.traversal.NodeIterator;
50+
import org.xml.sax.SAXException;
5951

6052
import com.cloud.agent.api.to.DatadiskTO;
53+
import com.cloud.agent.api.to.deployasis.OVFConfigurationTO;
54+
import com.cloud.agent.api.to.deployasis.OVFEulaSectionTO;
55+
import com.cloud.agent.api.to.deployasis.OVFNetworkTO;
56+
import com.cloud.agent.api.to.deployasis.OVFPropertyTO;
57+
import com.cloud.agent.api.to.deployasis.OVFVirtualHardwareItemTO;
58+
import com.cloud.agent.api.to.deployasis.OVFVirtualHardwareSectionTO;
59+
import com.cloud.configuration.Resource.ResourceType;
60+
import com.cloud.exception.InternalErrorException;
61+
import com.cloud.utils.Pair;
62+
import com.cloud.utils.compression.CompressionUtil;
6163
import com.cloud.utils.exception.CloudRuntimeException;
62-
import org.xml.sax.SAXException;
6364

6465
public class OVFHelper {
6566
private static final Logger s_logger = Logger.getLogger(OVFHelper.class);
@@ -496,7 +497,7 @@ private void writeDocumentToFile(String newOvfFilePath, Document doc) {
496497

497498
final StringWriter writer = new StringWriter();
498499
final StreamResult result = new StreamResult(writer);
499-
final TransformerFactory tf = TransformerFactory.newInstance();
500+
final TransformerFactory tf = ParserUtils.getSaferTransformerFactory();
500501
final Transformer transformer = tf.newTransformer();
501502
final DOMSource domSource = new DOMSource(doc);
502503
transformer.transform(domSource, result);

‎api/src/main/java/com/cloud/agent/api/storage/OVFParser.java‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,16 @@
1616
// under the License.
1717
package com.cloud.agent.api.storage;
1818

19+
import java.io.File;
20+
import java.io.IOException;
21+
import java.io.StringReader;
22+
import java.util.Map;
23+
24+
import javax.xml.parsers.DocumentBuilder;
25+
import javax.xml.parsers.DocumentBuilderFactory;
26+
import javax.xml.parsers.ParserConfigurationException;
27+
28+
import org.apache.cloudstack.utils.security.ParserUtils;
1929
import org.apache.commons.lang3.StringUtils;
2030
import org.apache.log4j.Logger;
2131
import org.w3c.dom.Document;
@@ -25,14 +35,6 @@
2535
import org.xml.sax.InputSource;
2636
import org.xml.sax.SAXException;
2737

28-
import javax.xml.parsers.DocumentBuilder;
29-
import javax.xml.parsers.DocumentBuilderFactory;
30-
import javax.xml.parsers.ParserConfigurationException;
31-
import java.io.File;
32-
import java.io.IOException;
33-
import java.io.StringReader;
34-
import java.util.Map;
35-
3638
public class OVFParser {
3739
private static final Logger s_logger = Logger.getLogger(OVFParser.class);
3840

@@ -47,7 +49,7 @@ public class OVFParser {
4749

4850
public OVFParser() {
4951
try {
50-
DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
52+
DocumentBuilderFactory documentBuilderFactory = ParserUtils.getSaferDocumentBuilderFactory();
5153
documentBuilderFactory.setNamespaceAware(true);
5254
documentBuilder = documentBuilderFactory.newDocumentBuilder();
5355
} catch (ParserConfigurationException e) {

‎plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -43,28 +43,29 @@
4343

4444
import javax.naming.ConfigurationException;
4545
import javax.xml.parsers.DocumentBuilder;
46-
import javax.xml.parsers.DocumentBuilderFactory;
4746
import javax.xml.parsers.ParserConfigurationException;
4847

49-
import com.cloud.configuration.Config;
5048
import org.apache.cloudstack.storage.configdrive.ConfigDrive;
5149
import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
5250
import org.apache.cloudstack.storage.to.TemplateObjectTO;
5351
import org.apache.cloudstack.storage.to.VolumeObjectTO;
52+
import org.apache.cloudstack.utils.bytescale.ByteScaleUtils;
5453
import org.apache.cloudstack.utils.hypervisor.HypervisorUtils;
5554
import org.apache.cloudstack.utils.linux.CPUStat;
5655
import org.apache.cloudstack.utils.linux.KVMHostInfo;
5756
import org.apache.cloudstack.utils.linux.MemStat;
5857
import org.apache.cloudstack.utils.qemu.QemuImg;
58+
import org.apache.cloudstack.utils.qemu.QemuImg.PhysicalDiskFormat;
5959
import org.apache.cloudstack.utils.qemu.QemuImgException;
6060
import org.apache.cloudstack.utils.qemu.QemuImgFile;
61-
import org.apache.cloudstack.utils.qemu.QemuImg.PhysicalDiskFormat;
6261
import org.apache.cloudstack.utils.security.KeyStoreUtils;
62+
import org.apache.cloudstack.utils.security.ParserUtils;
6363
import org.apache.commons.collections.MapUtils;
6464
import org.apache.commons.io.FileUtils;
6565
import org.apache.commons.lang.ArrayUtils;
6666
import org.apache.commons.lang.BooleanUtils;
6767
import org.apache.commons.lang.math.NumberUtils;
68+
import org.apache.commons.lang3.StringUtils;
6869
import org.apache.log4j.Logger;
6970
import org.joda.time.Duration;
7071
import org.libvirt.Connect;
@@ -118,6 +119,7 @@
118119
import com.cloud.agent.resource.virtualnetwork.VRScripts;
119120
import com.cloud.agent.resource.virtualnetwork.VirtualRouterDeployer;
120121
import com.cloud.agent.resource.virtualnetwork.VirtualRoutingResource;
122+
import com.cloud.configuration.Config;
121123
import com.cloud.dc.Vlan;
122124
import com.cloud.exception.InternalErrorException;
123125
import com.cloud.host.Host.Type;
@@ -187,8 +189,6 @@
187189
import com.cloud.vm.VirtualMachine;
188190
import com.cloud.vm.VirtualMachine.PowerState;
189191
import com.cloud.vm.VmDetailConstants;
190-
import org.apache.commons.lang3.StringUtils;
191-
import org.apache.cloudstack.utils.bytescale.ByteScaleUtils;
192192

193193
/**
194194
* LibvirtComputingResource execute requests on the computing/routing host using
@@ -4597,7 +4597,7 @@ public List<Ternary<String, Boolean, String>> cleanVMSnapshotMetadata(Domain dm)
45974597
snapshotCurrent.free();
45984598
DocumentBuilder builder;
45994599
try {
4600-
builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
4600+
builder = ParserUtils.getSaferDocumentBuilderFactory().newDocumentBuilder();
46014601

46024602
InputSource is = new InputSource();
46034603
is.setCharacterStream(new StringReader(snapshotXML));

‎plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtDomainXMLParser.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,11 @@
2222
import java.util.ArrayList;
2323
import java.util.Collections;
2424
import java.util.List;
25+
2526
import javax.xml.parsers.DocumentBuilder;
26-
import javax.xml.parsers.DocumentBuilderFactory;
2727
import javax.xml.parsers.ParserConfigurationException;
2828

29+
import org.apache.cloudstack.utils.security.ParserUtils;
2930
import org.apache.commons.lang3.StringUtils;
3031
import org.apache.log4j.Logger;
3132
import org.w3c.dom.Document;
@@ -42,8 +43,8 @@
4243
import com.cloud.hypervisor.kvm.resource.LibvirtVMDef.RngDef;
4344
import com.cloud.hypervisor.kvm.resource.LibvirtVMDef.RngDef.RngBackendModel;
4445
import com.cloud.hypervisor.kvm.resource.LibvirtVMDef.WatchDogDef;
45-
import com.cloud.hypervisor.kvm.resource.LibvirtVMDef.WatchDogDef.WatchDogModel;
4646
import com.cloud.hypervisor.kvm.resource.LibvirtVMDef.WatchDogDef.WatchDogAction;
47+
import com.cloud.hypervisor.kvm.resource.LibvirtVMDef.WatchDogDef.WatchDogModel;
4748

4849
public class LibvirtDomainXMLParser {
4950
private static final Logger s_logger = Logger.getLogger(LibvirtDomainXMLParser.class);
@@ -58,7 +59,7 @@ public class LibvirtDomainXMLParser {
5859
public boolean parseDomainXML(String domXML) {
5960
DocumentBuilder builder;
6061
try {
61-
builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
62+
builder = ParserUtils.getSaferDocumentBuilderFactory().newDocumentBuilder();
6263

6364
InputSource is = new InputSource();
6465
is.setCharacterStream(new StringReader(domXML));

‎plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtStoragePoolXMLParser.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@
2020
import java.io.StringReader;
2121

2222
import javax.xml.parsers.DocumentBuilder;
23-
import javax.xml.parsers.DocumentBuilderFactory;
2423
import javax.xml.parsers.ParserConfigurationException;
2524

25+
import org.apache.cloudstack.utils.security.ParserUtils;
2626
import org.apache.commons.lang3.StringUtils;
2727
import org.apache.log4j.Logger;
2828
import org.w3c.dom.Document;
@@ -38,7 +38,7 @@ public class LibvirtStoragePoolXMLParser {
3838
public LibvirtStoragePoolDef parseStoragePoolXML(String poolXML) {
3939
DocumentBuilder builder;
4040
try {
41-
builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
41+
builder = ParserUtils.getSaferDocumentBuilderFactory().newDocumentBuilder();
4242

4343
InputSource is = new InputSource();
4444
is.setCharacterStream(new StringReader(poolXML));

‎plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtStorageVolumeXMLParser.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@
2020
import java.io.StringReader;
2121

2222
import javax.xml.parsers.DocumentBuilder;
23-
import javax.xml.parsers.DocumentBuilderFactory;
2423
import javax.xml.parsers.ParserConfigurationException;
2524

25+
import org.apache.cloudstack.utils.security.ParserUtils;
2626
import org.apache.log4j.Logger;
2727
import org.w3c.dom.Document;
2828
import org.w3c.dom.Element;
@@ -37,7 +37,7 @@ public class LibvirtStorageVolumeXMLParser {
3737
public LibvirtStorageVolumeDef parseStorageVolumeXML(String volXML) {
3838
DocumentBuilder builder;
3939
try {
40-
builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
40+
builder = ParserUtils.getSaferDocumentBuilderFactory().newDocumentBuilder();
4141

4242
InputSource is = new InputSource();
4343
is.setCharacterStream(new StringReader(volXML));

‎plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtXMLParser.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
import javax.xml.parsers.SAXParser;
2424
import javax.xml.parsers.SAXParserFactory;
2525

26+
import org.apache.cloudstack.utils.security.ParserUtils;
2627
import org.apache.log4j.Logger;
2728
import org.xml.sax.InputSource;
2829
import org.xml.sax.SAXException;
@@ -32,8 +33,7 @@ public class LibvirtXMLParser extends DefaultHandler {
3233
private static final Logger s_logger = Logger.getLogger(LibvirtXMLParser.class);
3334
protected static final SAXParserFactory s_spf;
3435
static {
35-
s_spf = SAXParserFactory.newInstance();
36-
36+
s_spf = ParserUtils.getSaferSAXParserFactory();
3737
}
3838
protected SAXParser _sp;
3939
protected boolean _initialized = false;

‎plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtMigrateCommandWrapper.java‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -43,16 +43,15 @@
4343
import javax.xml.transform.dom.DOMSource;
4444
import javax.xml.transform.stream.StreamResult;
4545

46-
import com.cloud.agent.api.to.DiskTO;
47-
import com.cloud.agent.api.to.DpdkTO;
46+
import org.apache.cloudstack.utils.security.ParserUtils;
4847
import org.apache.commons.collections.MapUtils;
4948
import org.apache.commons.io.IOUtils;
5049
import org.apache.commons.lang3.StringUtils;
5150
import org.apache.log4j.Logger;
5251
import org.libvirt.Connect;
5352
import org.libvirt.Domain;
54-
import org.libvirt.DomainJobInfo;
5553
import org.libvirt.DomainInfo.DomainState;
54+
import org.libvirt.DomainJobInfo;
5655
import org.libvirt.LibvirtException;
5756
import org.libvirt.StorageVol;
5857
import org.w3c.dom.Document;
@@ -66,6 +65,8 @@
6665
import com.cloud.agent.api.MigrateAnswer;
6766
import com.cloud.agent.api.MigrateCommand;
6867
import com.cloud.agent.api.MigrateCommand.MigrateDiskInfo;
68+
import com.cloud.agent.api.to.DiskTO;
69+
import com.cloud.agent.api.to.DpdkTO;
6970
import com.cloud.agent.api.to.VirtualMachineTO;
7071
import com.cloud.agent.properties.AgentProperties;
7172
import com.cloud.agent.properties.AgentPropertiesFileHandler;
@@ -340,7 +341,7 @@ Use VIR_DOMAIN_XML_SECURE (value = 1) prior to v1.0.0.
340341
protected String replaceDpdkInterfaces(String xmlDesc, Map<String, DpdkTO> dpdkPortsMapping) throws TransformerException, ParserConfigurationException, IOException, SAXException {
341342
InputStream in = IOUtils.toInputStream(xmlDesc);
342343

343-
DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
344+
DocumentBuilderFactory docFactory = ParserUtils.getSaferDocumentBuilderFactory();
344345
DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
345346
Document doc = docBuilder.parse(in);
346347

@@ -488,7 +489,7 @@ protected String replaceStorage(String xmlDesc, Map<String, MigrateCommand.Migra
488489
throws IOException, ParserConfigurationException, SAXException, TransformerException {
489490
InputStream in = IOUtils.toInputStream(xmlDesc);
490491

491-
DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
492+
DocumentBuilderFactory docFactory = ParserUtils.getSaferDocumentBuilderFactory();
492493
DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
493494
Document doc = docBuilder.parse(in);
494495

@@ -634,7 +635,7 @@ private String getSourceText(Node diskNode) {
634635
}
635636

636637
private String getXml(Document doc) throws TransformerException {
637-
TransformerFactory transformerFactory = TransformerFactory.newInstance();
638+
TransformerFactory transformerFactory = ParserUtils.getSaferTransformerFactory();
638639
Transformer transformer = transformerFactory.newTransformer();
639640

640641
DOMSource source = new DOMSource(doc);
@@ -650,7 +651,7 @@ private String getXml(Document doc) throws TransformerException {
650651
private String replaceDiskSourceFile(String xmlDesc, String isoPath, String vmName) throws IOException, SAXException, ParserConfigurationException, TransformerException {
651652
InputStream in = IOUtils.toInputStream(xmlDesc);
652653

653-
DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
654+
DocumentBuilderFactory docFactory = ParserUtils.getSaferDocumentBuilderFactory();
654655
DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
655656
Document doc = docBuilder.parse(in);
656657

‎plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/CitrixResourceBase.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,17 +48,16 @@
4848
import java.util.concurrent.TimeoutException;
4949

5050
import javax.naming.ConfigurationException;
51-
import javax.xml.parsers.DocumentBuilderFactory;
5251
import javax.xml.parsers.ParserConfigurationException;
5352

54-
import com.cloud.resource.ServerResourceBase;
5553
import org.apache.cloudstack.api.ApiConstants;
5654
import org.apache.cloudstack.diagnostics.CopyToSecondaryStorageAnswer;
5755
import org.apache.cloudstack.diagnostics.CopyToSecondaryStorageCommand;
5856
import org.apache.cloudstack.diagnostics.DiagnosticsService;
5957
import org.apache.cloudstack.hypervisor.xenserver.ExtraConfigurationUtility;
6058
import org.apache.cloudstack.storage.to.TemplateObjectTO;
6159
import org.apache.cloudstack.storage.to.VolumeObjectTO;
60+
import org.apache.cloudstack.utils.security.ParserUtils;
6261
import org.apache.commons.collections.CollectionUtils;
6362
import org.apache.commons.collections.MapUtils;
6463
import org.apache.commons.io.FileUtils;
@@ -122,6 +121,7 @@
122121
import com.cloud.network.Networks.BroadcastDomainType;
123122
import com.cloud.network.Networks.TrafficType;
124123
import com.cloud.resource.ServerResource;
124+
import com.cloud.resource.ServerResourceBase;
125125
import com.cloud.resource.hypervisor.HypervisorResource;
126126
import com.cloud.storage.Storage;
127127
import com.cloud.storage.Storage.StoragePoolType;
@@ -3199,7 +3199,7 @@ protected Document getStatsRawXML(final Connection conn, final boolean host) {
31993199
final URLConnection uc = url.openConnection();
32003200
in = new BufferedReader(new InputStreamReader(uc.getInputStream()));
32013201
final InputSource statsSource = new InputSource(in);
3202-
return DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(statsSource);
3202+
return ParserUtils.getSaferDocumentBuilderFactory().newDocumentBuilder().parse(statsSource);
32033203
} catch (final MalformedURLException e) {
32043204
s_logger.warn("Malformed URL? come on...." + urlStr);
32053205
return null;

‎plugins/network-elements/cisco-vnmc/src/main/java/com/cloud/network/cisco/CiscoVnmcConnectionImpl.java‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,7 @@
2525
import java.util.List;
2626
import java.util.Map;
2727

28-
import javax.xml.parsers.DocumentBuilderFactory;
29-
28+
import org.apache.cloudstack.utils.security.ParserUtils;
3029
import org.apache.commons.httpclient.HttpClient;
3130
import org.apache.commons.httpclient.HttpStatus;
3231
import org.apache.commons.httpclient.contrib.ssl.EasySSLProtocolSocketFactory;
@@ -1289,7 +1288,7 @@ private Document getDocument(String xml) throws ExecutionException {
12891288
Document doc = null;
12901289

12911290
try {
1292-
doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(xmlSource);
1291+
doc = ParserUtils.getSaferDocumentBuilderFactory().newDocumentBuilder().parse(xmlSource);
12931292

12941293
} catch (Exception e) {
12951294
s_logger.error(e);

0 commit comments

Comments
 (0)