/*
|
* The contents of this file are subject to the terms of the Common Development and
|
* Distribution License (the License). You may not use this file except in compliance with the
|
* License.
|
*
|
* You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
|
* specific language governing permission and limitations under the License.
|
*
|
* When distributing Covered Software, include this CDDL Header Notice in each file and include
|
* the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
|
* Header, with the fields enclosed by brackets [] replaced by your own identifying
|
* information: "Portions copyright [year] [name of copyright owner]".
|
*
|
* Copyright 2026 3A Systems, LLC.
|
*/
|
package org.opends.dsml.protocol;
|
|
import java.io.ByteArrayInputStream;
|
import java.io.IOException;
|
import java.nio.charset.StandardCharsets;
|
import java.nio.file.Files;
|
import java.nio.file.Path;
|
import java.util.Comparator;
|
import java.util.stream.Stream;
|
|
import javax.xml.parsers.DocumentBuilderFactory;
|
|
import org.forgerock.testng.ForgeRockTestCase;
|
import org.testng.annotations.AfterClass;
|
import org.testng.annotations.BeforeClass;
|
import org.testng.annotations.DataProvider;
|
import org.testng.annotations.Test;
|
import org.w3c.dom.Document;
|
|
import jakarta.xml.soap.MessageFactory;
|
import jakarta.xml.soap.MimeHeaders;
|
import jakarta.xml.soap.SOAPConstants;
|
import jakarta.xml.soap.SOAPException;
|
import jakarta.xml.soap.SOAPMessage;
|
|
import static org.testng.Assert.assertFalse;
|
import static org.testng.Assert.assertTrue;
|
|
/**
|
* Pins the entity-expansion behaviour of the SAAJ implementation the DSMLv2
|
* gateway parses requests with.
|
* <p>
|
* {@link DSMLServlet#doPost} hands the request body straight to
|
* {@code MessageFactory.createMessage(MimeHeaders, InputStream)}, which builds
|
* its own parser: the servlet cannot configure it, and the SAAJ API offers no
|
* way to assert that it is safe. The protection therefore comes from the
|
* implementation on the classpath, and swapping that implementation would
|
* remove it silently - hence this test (GHSA-jr68-5c58-j463).
|
* <p>
|
* The tests only ever reference {@code file:} URIs under a temporary
|
* directory, so they perform no network or DNS I/O.
|
*/
|
@SuppressWarnings("javadoc")
|
@Test(groups = { "precommit", "dsml" })
|
public class SoapEntityExpansionTestCase extends ForgeRockTestCase
|
{
|
private static final String CANARY = "s3cr3t-canary-value";
|
/** Literal text sitting next to the entity reference in every payload. */
|
private static final String MARKER = "attribute-value-marker";
|
private static final String SOAP_11_CONTENT_TYPE = "text/xml; charset=utf-8";
|
private static final String SOAP_12_CONTENT_TYPE = "application/soap+xml; charset=utf-8";
|
|
private Path tempDir;
|
/** File an XXE payload tries to read. */
|
private String canaryUri;
|
/** External DTD subset declaring an entity which reads the canary file. */
|
private String externalDtdUri;
|
|
@BeforeClass
|
public void createPayloadFiles() throws IOException
|
{
|
tempDir = Files.createTempDirectory("dsml-xxe-test");
|
Path canary = Files.write(tempDir.resolve("canary.txt"), CANARY.getBytes(StandardCharsets.UTF_8));
|
canaryUri = canary.toUri().toASCIIString();
|
Path dtd = Files.write(tempDir.resolve("canary.dtd"),
|
("<!ENTITY xxe SYSTEM \"" + canaryUri + "\">").getBytes(StandardCharsets.UTF_8));
|
externalDtdUri = dtd.toUri().toASCIIString();
|
}
|
|
@AfterClass
|
public void deletePayloadFiles() throws IOException
|
{
|
if (tempDir != null)
|
{
|
try (Stream<Path> paths = Files.walk(tempDir))
|
{
|
paths.sorted(Comparator.reverseOrder()).forEach(path -> path.toFile().delete());
|
}
|
}
|
}
|
|
@DataProvider
|
public Object[][] entityPayloads()
|
{
|
return new Object[][] {
|
{ "SOAP 1.1, external general entity", SOAPConstants.SOAP_1_1_PROTOCOL, SOAP_11_CONTENT_TYPE,
|
"<?xml version=\"1.0\"?>"
|
+ "<!DOCTYPE soapenv:Envelope [<!ENTITY xxe SYSTEM \"" + canaryUri + "\">]>"
|
+ soap11Envelope("&xxe;") },
|
{ "SOAP 1.1, external DTD subset", SOAPConstants.SOAP_1_1_PROTOCOL, SOAP_11_CONTENT_TYPE,
|
"<?xml version=\"1.0\"?>"
|
+ "<!DOCTYPE soapenv:Envelope SYSTEM \"" + externalDtdUri + "\">"
|
+ soap11Envelope("&xxe;") },
|
{ "SOAP 1.2, external general entity", SOAPConstants.SOAP_1_2_PROTOCOL, SOAP_12_CONTENT_TYPE,
|
"<?xml version=\"1.0\"?>"
|
+ "<!DOCTYPE env:Envelope [<!ENTITY xxe SYSTEM \"" + canaryUri + "\">]>"
|
+ soap12Envelope("&xxe;") },
|
{ "SOAP 1.2, external DTD subset", SOAPConstants.SOAP_1_2_PROTOCOL, SOAP_12_CONTENT_TYPE,
|
"<?xml version=\"1.0\"?>"
|
+ "<!DOCTYPE env:Envelope SYSTEM \"" + externalDtdUri + "\">"
|
+ soap12Envelope("&xxe;") },
|
};
|
}
|
|
/**
|
* A request declaring an external entity must either be rejected outright,
|
* or be parsed without the entity ever being resolved. Both outcomes keep
|
* the file contents out of the batch request; anything else is an XXE.
|
*/
|
@Test(dataProvider = "entityPayloads")
|
public void testExternalEntityIsNeverExpanded(String label, String protocol, String contentType,
|
String request) throws Exception
|
{
|
String body;
|
try
|
{
|
body = parseBody(protocol, contentType, request);
|
}
|
catch (SOAPException e)
|
{
|
// Rejected before any entity could be resolved.
|
return;
|
}
|
// The implementation parsed the request instead of rejecting it. The rest
|
// of this method is then the assertion that matters, so first make sure it
|
// is looking at a body that really was parsed - an empty one would satisfy
|
// the check below without proving anything.
|
assertTrue(body.contains(MARKER),
|
label + ": the request was accepted but its body is not there: " + body);
|
assertFalse(body.contains(CANARY),
|
label + ": the external entity was expanded into the request body: " + body);
|
}
|
|
/** The rejection above must not come from the gateway refusing plain requests. */
|
@Test
|
public void testRequestWithoutDoctypeIsParsed() throws Exception
|
{
|
String body = parseBody(SOAPConstants.SOAP_1_1_PROTOCOL, SOAP_11_CONTENT_TYPE,
|
"<?xml version=\"1.0\"?>" + soap11Envelope("a plain attribute value"));
|
assertTrue(body.contains("a plain attribute value"), "unexpected body: " + body);
|
}
|
|
/**
|
* The payloads above are only worth anything if they would actually leak the
|
* file through a parser that is not protected - otherwise the whole test case
|
* could keep passing against an implementation that stopped protecting
|
* anything. This is that control: the very same request, through a plain
|
* DocumentBuilder, must hand the file contents over.
|
*/
|
@Test
|
public void testPayloadLeaksThroughAnUnprotectedParser() throws Exception
|
{
|
String request = null;
|
for (Object[] payload : entityPayloads())
|
{
|
if (((String) payload[0]).contains("external general entity"))
|
{
|
request = (String) payload[3];
|
break;
|
}
|
}
|
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
|
factory.setNamespaceAware(true);
|
Document document = factory.newDocumentBuilder()
|
.parse(new ByteArrayInputStream(request.getBytes(StandardCharsets.UTF_8)));
|
assertTrue(document.getDocumentElement().getTextContent().contains(CANARY),
|
"the XXE payload no longer reads the file even without any protection, "
|
+ "so this test case proves nothing anymore");
|
}
|
|
/** Parses a request the way {@link DSMLServlet#doPost} does, and returns the body as text. */
|
private String parseBody(String protocol, String contentType, String request) throws Exception
|
{
|
MimeHeaders mimeHeaders = new MimeHeaders();
|
mimeHeaders.addHeader("Content-Type", contentType);
|
SOAPMessage message = MessageFactory.newInstance(protocol).createMessage(mimeHeaders,
|
new ByteArrayInputStream(request.getBytes(StandardCharsets.UTF_8)));
|
// SAAJ parses lazily, the body is only built here.
|
return message.getSOAPBody().getTextContent();
|
}
|
|
private static String soap11Envelope(String dn)
|
{
|
return "<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\">"
|
+ "<soapenv:Body>" + batchRequest(dn) + "</soapenv:Body></soapenv:Envelope>";
|
}
|
|
private static String soap12Envelope(String dn)
|
{
|
return "<env:Envelope xmlns:env=\"http://www.w3.org/2003/05/soap-envelope\">"
|
+ "<env:Body>" + batchRequest(dn) + "</env:Body></env:Envelope>";
|
}
|
|
/**
|
* A batch request carrying the given text as an attribute value, so that an
|
* expanded entity ends up in the text content of the SOAP body. The value is
|
* prefixed with {@link #MARKER}, which tells a body that was parsed without
|
* expanding the entity from a body that was never parsed at all.
|
*/
|
private static String batchRequest(String value)
|
{
|
return "<batchRequest xmlns=\"urn:oasis:names:tc:DSML:2:0:core\">"
|
+ "<addRequest dn=\"cn=probe,dc=example,dc=com\">"
|
+ "<attr name=\"description\"><value>" + MARKER + value + "</value></attr>"
|
+ "</addRequest></batchRequest>";
|
}
|
}
|
