CodeQL query to detect XSLT injections#3363
Conversation
|
@ggolawski could you please add support for SAXON (e.g: |
|
@pwntester I'll add support for SAXON. Does it make sense to add support for Xalan 1.x? What do you think? |
|
Makes sense not to support 1.x than, thanks! |
|
@pwntester I've addedd support for Saxon. The following cases are supported: public void testSaxon(Socket socket) throws Exception {
StreamSource source = new StreamSource(socket.getInputStream());
XsltCompiler compiler = new Processor(true).newXsltCompiler();
compiler.compile(source).load().transform();
compiler.compile(source).load30().transform(null, null);
compiler.compile(source).load30().applyTemplates((Source) null);
compiler.compile(source).load30().applyTemplates((Source) null, null);
compiler.compile(source).load30().applyTemplates((XdmValue) null);
compiler.compile(source).load30().applyTemplates((XdmValue) null, null);
compiler.compile(source).load30().callFunction(null, null);
compiler.compile(source).load30().callFunction(null, null, null);
compiler.compile(source).load30().callTemplate(null);
compiler.compile(source).load30().callTemplate(null, null);
}
public void testSaxonXsltPackage(@RequestParam String param, Socket socket) throws Exception {
URI uri = new URI(param);
StreamSource source = new StreamSource(socket.getInputStream());
XsltCompiler compiler = new Processor(true).newXsltCompiler();
compiler.loadExecutablePackage(uri).load().transform();
compiler.compilePackage(source).link().load().transform();
compiler.loadLibraryPackage(uri).link().load().transform();
} |
felicitymay
left a comment
There was a problem hiding this comment.
I should have mentioned earlier, I was added as a reviewer automatically by the CODEOWNERS file. However this PR doesn't need a review from the docs team because it's changing the experimental directory. We've since updated the CODEOWNERS file to reflect this.
aschackmull
left a comment
There was a problem hiding this comment.
LGTM. The test needs a minor tweak, but otherwise this looks ready to merge.
This PR adds a query to detect XSLT injections. It flags the code where user-provided XSLT stylesheet is processed by
Transformer.transform. The following use cases are supported:StreamSource:SAXSource:StAXSource:DOMSource:Transformerobject created fromTemplates:Processing of unvalidated XSLT stylesheets can lead to XXE or remote code execution.
This query partially overlaps with XXE query from
XXE.ql, but has the following noticeable differences:ACCESS_EXTERNAL_STYLESHEETandACCESS_EXTERNAL_SCHEMAare disabled. Disabling these options is enough to prevent XXE, but not enough to prevent RCE via XSLT injection. To prevent it,FEATURE_SECURE_PROCESSINGmust be enabled.Document). XsltInjection query always highlights the source code line where the transformation happens (Transformer.transformmethod invocation) - this is the place where XSLT injection (which can lead to RCE) happens.Transformeris created fromTemplates(TransformerFactory.newTemplates(source).newTransformer().transform()) is not supported by XXE query.The tests are also included.