org.apache.synapse.mediators, config.xml).apache/synapse master @ 0b40f4d7d7777d109f167c0b4afa21afbfb10988 (2026-06-15), with dependency defaults verified against Axis2 1.7.9 and Axiom 1.2.22 (the versions pinned in the root pom.xml).threat-model-producer rubric (https://gist.github.com/potiuk/da14a826283038ddfe38cc9fe6310573). Reviewed by the Synapse PMC.Framing note (as for any framework): Synapse is a mediation engine, not a finished application. The integration developer authors the synapse configuration — sequences, mediators, scripts, XSLT/XQuery, endpoints, and security policies. That configuration is trusted input (§3); the inbound message from a network client is the untrusted adversary input (§7). Most properties are conditional on how the integration is configured, so §9/§10 carry a lot of weight.
Intended use (documented): deploy Synapse as a message broker/mediator in front of or between services — clients send messages to a Synapse proxy/API; Synapse mediates (transform, route, secure, throttle) and forwards to backend endpoints. In message-mediation mode, Synapse additionally acts as a WS-Addressing-style router: a bare <send/> with no configured endpoint forwards to the message's implicit To address (source-verified — SendMediator.mediate(); see §9).
Caller roles:
Component-family table:
| Family | Entry point | Touches outside process | In model? |
|---|---|---|---|
| Transport listeners | HTTP/S (NHTTP/passthrough), JMS, VFS, Mail | network / fs / mail | Yes |
| Mediation engine | sequences / proxy services / APIs | — | Yes |
| XML transform mediators | XSLT, XQuery, payload factory | XML; external refs | Yes (high-value) |
| Script mediators | JS/Groovy/… (operator-authored) | runs config code over message data | Yes (data-in surface) |
| Endpoints (outbound) | send/call mediators, address/WSDL/loadbalance | network egress | Yes (SSRF surface) |
| Eventing | WS-Eventing subscriptions | network | Yes |
| Secrets / secure-vault | encrypted config secrets | keystore | Yes |
| Samples / docs / build | modules/documentation, samples, tests | — | No → §3 |
synapse.xml/registry, never from messages).modules/samples, modules/documentation, src/test trees).StAXParserConfiguration.SOAP.The trust boundary is the transport listener + the mediation entry: bytes arriving on a listener are untrusted until mediation (and any configured WS-Security/transport auth) has processed them.
Trust transitions:
BuilderUtil.createSOAPModelBuilder / createPOXBuilder, which use Axiom StAXParserConfiguration.SOAP → StAXDialect.disallowDoctypeDecl. A DOCTYPE declaration in an inbound message is rejected outright, which blocks classic XXE and DTD-based entity-expansion (billion-laughs) by default. The passthrough HTTP transport additionally defers building the message body (RelayUtils/DeferredMessageBuilder): the envelope is only parsed when a mediator actually needs it, so pure-routing configurations never parse untrusted bodies at all. There are, however, no built-in message-size or element-depth limits in the NHTTP/passthrough transports (§9).TransformerFactory with JAXP defaults — FEATURE_SECURE_PROCESSING is not set (source-verified — XSLTMediator); stylesheet functions such as document() / doc() (XQuery via Saxon XQJ) therefore remain available. Because the stylesheet/query body is trusted config, this becomes an attacker surface only when the operator's stylesheet feeds message-derived strings into document()/doc() or extension functions — an integration responsibility (§9/§10), with a per-mediator hardening knob available (<feature>/<attribute> elements on <xslt> can enable secure-processing — §5a).To routing — <send/> with no endpoint forwards to the inbound message's To address (source-verified — SendMediator). Both are SSRF surfaces the integration must constrain (§9/§10).Reachability precondition: a finding is in-model if reachable from an inbound message before the mediation auth/validation the integration configured; a finding requiring a malicious config (script, XSLT body, endpoint address chosen by the operator) is OUT-OF-MODEL: trusted-input (§3/§6).
synapse.xml config, keystores, and transport setup.org.apache.synapse.securevault: keystore-backed asymmetric/symmetric ciphers; PasswordManager resolves encrypted passwords at runtime).| Knob | Effect | Ruling |
|---|---|---|
| Inbound XML DOCTYPE handling | XXE / entity-expansion | Resolved (source-verified): DOCTYPE rejected by default on SOAP and POX build paths (StAXParserConfiguration.SOAP). No supported knob re-enables it per-service; a report reaching XXE through the default build path is VALID. |
<xslt> <feature>/<attribute> elements | Per-mediator TransformerFactory features (e.g. http://javax.xml.XMLConstants/feature/secure-processing) | Resolved (source-verified): off by default (JAXP defaults apply); enabling secure-processing is an operator hardening opt-in. |
| Message size / element-depth limits | XML/large-message DoS | Resolved (source-verified): no built-in limits in NHTTP/passthrough. Passthrough streaming + deferred building bound the pure-routing path; parsing paths rely on deployment controls (§5, §10). Documented as a §9 disclaimed property. |
Dynamic / content-based endpoint resolution; implicit To routing via bare <send/> | SSRF if destination derived from message | Resolved (source-verified): implicit To routing is designed-in for message-mediation mode; no built-in allow-listing. Validation is the integration's job (§9/§10). |
| Transport TLS (HTTPS listener + outbound) | Confidentiality/integrity | Operator (§10). |
| WS-Security (Rampart) on a proxy | Message-level auth/sig/enc | Integration choice. |
| Script-mediator languages enabled | Operator-code surface | Operator config. |
| Entry point | Parameter | Attacker-controllable? | Caller/operator must enforce |
|---|---|---|---|
| transport listener | message body (SOAP/XML/JSON/binary), headers, SOAPAction, To/request URI | yes | deployment size caps; transport/WS-Security |
| XSLT/XQuery mediator | message payload (the transform input) | yes | don't pass message data into document()/doc()/extensions; optionally enable secure-processing |
| script mediator | message payload passed to the script | yes | safe handling of message data in the script |
dynamic endpoint / bare <send/> | destination derived from message (To, headers, XPath) | yes (if configured / message-mediation mode) | validate/allow-list resolved addresses |
| synapse config (sequences, scripts, XSLT, endpoints, secrets) | all | no — operator-trusted | never sourced from a message |
To/routing value that mediation turns into an outbound destination (SSRF), or data that a script mishandles. (DOCTYPE-based payloads — XXE, billion-laughs — are rejected at the build boundary by default; §4.1.)BuilderUtil + Axiom StAXParserConfiguration.SOAP, versions pinned in §1). Symptom of violation: an entity defined via DOCTYPE in an inbound message is resolved/expanded on a default build path. Severity: critical.RelayUtils/DeferredMessageBuilder). Resource bounding of parsed messages is NOT provided — see §9. Symptom: crash or memory corruption (not mere resource exhaustion) from crafted input. Severity: high.org.apache.synapse.securevault). Symptom: plaintext secret in config at rest, or secret emitted to logs by the framework. Severity: high.BY-DESIGN: property-disclaimed, not VALID, unless they show asymmetric amplification beyond input size.To routing of a bare <send/> in message-mediation mode (source-verified — SendMediator). Validating/allow-listing destinations is the integration's job.FEATURE_SECURE_PROCESSING is not set on the TransformerFactory; operators who pass message data into resolution-capable constructs must enable it per-mediator (§5a) or avoid the construct.False friends:
document()/doc() or extension functions — reachable when the trusted stylesheet feeds message-derived strings into them (the message itself cannot introduce a DTD; §4.1/§4.2).<send/> looks like internal plumbing but is a client-steered router — the destination is the inbound message's To.Well-known attack classes to keep in view: SSRF via message-derived routing and via transform resolution; oversized-message / deep-nesting DoS on parsing paths; injection into a downstream system via an unsanitized transform; secret exposure through an over-broad transform or log mediator; XML signature-wrapping where WS-Security is used (see the CXF/WSS4J model). (XXE / DTD entity-expansion is default-blocked — §8.1 — and would signal a regression in the §1-pinned builder configuration.)
<send/> on untrusted traffic unless client-steered routing is intended and network-constrained (anti-SSRF).document()/doc()/extension functions in stylesheets and queries; where unavoidable, enable secure-processing on that mediator (§5a) and restrict egress.<send/> (or content-derived endpoint) on an internet-facing service with unrestricted egress (SSRF).document()/doc()/extension functions.(Seed list; the PMC owns the authoritative version)
OUT-OF-MODEL: non-default-build. Against the default build path (§8.1) it would be VALID.<send/>/implicit To routing — designed-in router semantics; disclaimed (§9) → BY-DESIGN: property-disclaimed (constraining it is §10). A report showing it bypasses an explicitly configured endpoint or allow-list would be VALID.BY-DESIGN: property-disclaimed. Asymmetric amplification remains in-model under §8.2.XMLInputFactory without hardening in config/registry loaders (SynapseConfigUtils, SimpleURLRegistry) — these parse operator-trusted configuration, not messages → OUT-OF-MODEL: trusted-input.FEATURE_SECURE_PROCESSING by default on transform mediators.| Disposition | Meaning | Licensed by |
|---|---|---|
VALID | Violates a claimed property via an in-scope adversary/input in a default config. | §8, §6, §7 |
VALID-HARDENING | No §8 property broken, but a §11 misuse warrants a safer default/guard. | §11 |
OUT-OF-MODEL: trusted-input | Requires control of the synapse config (script/XSLT/endpoint/secret). | §6, §3 |
OUT-OF-MODEL: adversary-not-in-scope | Requires operator/keystore capability. | §7, §3 |
OUT-OF-MODEL: unsupported-component | Lands in samples/docs/tests. | §3 |
OUT-OF-MODEL: non-default-build | Only when an insecure non-default parser/builder/resolution option was enabled. | §5a |
BY-DESIGN: property-disclaimed | Concerns a §9-disclaimed property (size limits; implicit To routing; no security without config; scripts are operator code). | §9 |
KNOWN-NON-FINDING | Matches a §11a entry. | §11a |
MODEL-GAP | Routes to none of the above → revise the model. | §12 |
Deferred; a threat-model.yaml can later encode the §6 trust table, §2/§3 scoping, §8 rows, §9 false friends, §11a non-findings, and §13 dispositions.