🔒️ Enhance XML security

Author: coreequip

.dockerignore

@@ -0,0 +1,3 @@
+**/.DS_Store
+**/LICENSE
+**/*.md

Dockerfile

@@ -1,10 +1,13 @@
 FROM eclipse-temurin:21-alpine
 
+RUN adduser -H -D xrviz xrviz
+USER xrviz
+
 WORKDIR /app
 
-COPY build/libs/xrviz.jar /app/xrviz.jar
-COPY data /app/data
+COPY --chown=xrviz:xrviz build/libs/xrviz.jar /app/xrviz.jar
+COPY --chown=xrviz:xrviz data /app/data
 
 EXPOSE 4000
 
-CMD ["java", "-jar", "/app/xrviz.jar"]
+CMD ["java", "-jar", "xrviz.jar"]

gradle.properties

@@ -1,2 +1,2 @@
-currentVersion=0.1.10
+currentVersion=0.1.11
 mainClassName=io.github.easybill.xrviz.App

src/main/java/io/github/easybill/xrviz/XslTransformer.java

@@ -3,8 +3,10 @@
 import org.apache.fop.apps.*;
 import org.xml.sax.InputSource;
 import org.xml.sax.SAXException;
+import org.xml.sax.XMLReader;
 
-import javax.xml.transform.Source;
+import javax.xml.parsers.SAXParser;
+import javax.xml.parsers.SAXParserFactory;
 import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerException;
 import javax.xml.transform.TransformerFactory;
@@ -30,6 +32,22 @@ public class XslTransformer {
     public static final String UBL_I_VALIDATION_STRING = "Invoice";
     public static final String UBL_C_VALIDATION_STRING = "CreditNote";
     public static final Pattern REGEX = Pattern.compile("[<:](CrossIndustryInvoice|Invoice|CreditNote)");
+    private static final XMLReader xmlReader;
+
+    static {
+        try {
+            SAXParserFactory factory = SAXParserFactory.newInstance();
+            SAXParser saxParser = factory.newSAXParser();
+            xmlReader = saxParser.getXMLReader();
+            xmlReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+            xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", false);
+            xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+        } catch (Exception e) {
+            logger.log(Level.SEVERE, "Error initializing XMLReader", e);
+            throw new RuntimeException(e);
+        }
+    }
+
 
     enum DocumentType {
         CII("cii-xr.xsl"),
@@ -91,9 +109,9 @@ private static DOMSource transformXmlToXr(String inputXml, DocumentType type) th
         TransformerFactory factory = TransformerFactory.newInstance();
         StreamSource source = new StreamSource("data/xsl/" + type.getXslName());
         Transformer transformer = factory.newTransformer(source);
-        Source xml = new StreamSource(new StringReader(inputXml));
+        SAXSource saxSource = new SAXSource(xmlReader, new InputSource(new StringReader(inputXml)));
         DOMResult domResult = new DOMResult();
-        transformer.transform(xml, domResult);
+        transformer.transform(saxSource, domResult);
         return new DOMSource(domResult.getNode());
     }
 

src/main/java/io/github/easybill/xrviz/handler/HtmlHandler.java

@@ -6,6 +6,7 @@
 
 import javax.xml.transform.TransformerException;
 import java.io.IOException;
+import java.net.HttpURLConnection;
 import java.nio.charset.StandardCharsets;
 
 public class HtmlHandler extends XmlRequestExtractor implements HttpHandler {
@@ -27,7 +28,7 @@ public void handle(HttpExchange exchange) throws IOException {
             exchange.getResponseBody().close();
 
         } catch (TransformerException e) {
-            exchange.sendResponseHeaders(500, -1);
+            exchange.sendResponseHeaders(HttpURLConnection.HTTP_BAD_REQUEST, -1);
 
             logger.severe("Error while transforming XML to HTML: " + e.getMessage());
         }