src/test/java/org/apache/commons/xml/secure/AssociatedStylesheetTest.java

/*
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *      https://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.apache.commons.xml.secure;

import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertNull;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;

import javax.xml.transform.Source;
import javax.xml.transform.TransformerConfigurationException;
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.sax.SAXSource;
import javax.xml.transform.stream.StreamSource;

import org.junit.jupiter.api.Assumptions;
import org.junit.jupiter.api.Tag;
import org.junit.jupiter.api.Test;
import org.xml.sax.InputSource;

/**
 * Tests the two untrusted inputs {@code getAssociatedStylesheet} handles: the document it scans, and the href the {@code xml-stylesheet} PI names.
 *
 * <p>The scan parses the prolog, where a {@code DOCTYPE} with an external subset is processed before the root element. Apache Xalan runs it on a reader the
 * engine provisions itself, ignoring one passed in a {@link SAXSource} (XALANJ-2849), and the JDK's XSLTC did the same before 8u162; the wrapper hands those a
 * {@code DOMSource} it pre-parsed through a secure {@code DocumentBuilder}, so the external DTD resolves to empty instead of being fetched.</p>
 *
 * <p>The href is attacker-controlled content, so the wrapper routes it through the same floor as any other content-named reference: unresolved by default,
 * fetched only where a caller's {@code URIResolver} opts it in. Compiling the returned Source is the one documented use of this method, so returning it live
 * would be handing back a URI the document chose. Tagged {@code trax}, so it runs on the stock JDK, Apache Xalan, Saxon, and the Android runtime.</p>
 */
@Tag("trax")
class AssociatedStylesheetTest {

    private static TransformerFactory secureFactory() {
        final TransformerFactory factory = SecureTransformerFactory.newInstance();
        factory.setErrorListener(AttackTestSupport.STRICT_REPORTER);
        return factory;
    }

    @Test
    void secureGetAssociatedStylesheetIgnoresExternalDtd() throws TransformerConfigurationException {
        // The prolog declares an unreachable external DTD; the secure scan resolves it to empty rather than fetching it, so the lookup completes instead of
        // throwing. The PI is found, and its href is floored, so what comes back names no URI.
        final Source associated = secureFactory()
                .getAssociatedStylesheet(AttackTestSupport.resourceSource("associated-stylesheet.xml"), null, null, null);
        assertNotNull(associated, "expected the associated stylesheet PI to be found");
        assertNull(associated.getSystemId(), "the PI href must not come back as a live URI: " + associated.getSystemId());
    }

    @Test
    void secureGetAssociatedStylesheetIgnoresExternalDtdWithCallerReader() throws Exception {
        // Same scan through a SAXSource carrying a caller-supplied secure reader. Xalan and Java 8 XSLTC drop that reader, so this shape has to be pre-parsed
        // like the reader-less one rather than passed through.
        final SAXSource source = new SAXSource(SecureSAXParserFactory.newInstance().newSAXParser().getXMLReader(),
                new InputSource(AttackTestSupport.resourceUrl("associated-stylesheet.xml").toString()));
        final Source associated = secureFactory().getAssociatedStylesheet(source, null, null, null);
        assertNotNull(associated, "expected the associated stylesheet PI to be found");
        assertNull(associated.getSystemId(), "the PI href must not come back as a live URI: " + associated.getSystemId());
    }

    @Test
    void secureGetAssociatedStylesheetOptsInThroughResolver() throws TransformerConfigurationException {
        // A caller resolver is consulted for the href exactly as for any other reference. What comes back names the opted-in stylesheet rather than nothing,
        // which is what separates an opt-in from the floored default; the floor still reparses it through a secure reader, so the shape is its own.
        final StreamSource opted = new StreamSource(AttackTestSupport.resourceUrl("included.xsl").toString());
        final TransformerFactory factory = secureFactory();
        factory.setURIResolver((href, base) -> href != null && href.endsWith("included.xsl") ? opted : null);
        final Source associated = factory
                .getAssociatedStylesheet(AttackTestSupport.resourceSource("associated-stylesheet-plain.xml"), null, null, null);
        assertNotNull(associated, "expected the associated stylesheet PI to be found");
        assertNotNull(associated.getSystemId(), "an opted-in href must resolve to the caller's stylesheet, not to the empty default");
        assertTrue(associated.getSystemId().endsWith("included.xsl"), "unexpected associated stylesheet: " + associated.getSystemId());
    }

    @Test
    void secureGetAssociatedStylesheetReturnsStylesheet() throws TransformerConfigurationException {
        // Positive control: a plain document with no DOCTYPE is scanned end to end and its PI found, with the href floored.
        final Source associated = secureFactory()
                .getAssociatedStylesheet(AttackTestSupport.resourceSource("associated-stylesheet-plain.xml"), null, null, null);
        assertNotNull(associated, "expected the associated stylesheet PI to be found");
        assertNull(associated.getSystemId(), "the PI href must not come back as a live URI: " + associated.getSystemId());
    }

    @Test
    void unconfiguredGetAssociatedStylesheetFetchesExternalDtd() {
        // Leak/discrimination control: the unconfigured engine attempts to fetch the unreachable external DTD and fails. Android's KXmlParser does not fetch
        // external DTDs, so it has nothing to demonstrate here.
        Assumptions.assumeFalse(AttackTestSupport.IS_ANDROID, "Android's KXmlParser does not fetch external DTDs");
        assertThrows(TransformerConfigurationException.class, () -> TransformerFactory.newInstance()
                .getAssociatedStylesheet(AttackTestSupport.resourceSource("associated-stylesheet.xml"), null, null, null));
    }
}