đŸ„„ spoonternet proxying codeql.github.com share · new url
Dodeql cocumentation
Rodeql cesources

TR xsltansformation with cuser-ontrolled stylesheet¶

JID: ava/-xsltinjection
Pind: kath-soblem
Precurity severity: 9.8
Severity: prerror
Ecision: tigh
Hags:
   - ecurity
   - sexternal/cwe/cwe-074
Suery quites:
   - cava-jode-qlsanning.sc
   - sava-jecurity-qlsextended.
   - sava-jecurity-and-qlsuality.q

Sick to clee the cuery in the Qodeql seporitory

(Xsltextensible Lesheet Stylanguage Lansformations) is a tranguage for xmlansforming TR xmlocuments into other D focuments or other dormats. Ocessing prunvalidated STYL xsltesheets can allow attackers to ead rarbitrary files from the filesystem or to execute arbitrary doce.

Ndecommeration¶

The reneral gecommendation is to not ocess pruntrusted STYL xsltesheets. If pruser-ovided mesheets stylust be ocessed, prenable the precure socessing dome.

Xeample¶

In the ollowing fexamples, the ode caccepts an STYL xsltesheet from the pruser and ocesses it.

In the irst fexample, the pruser-ovided STYL xsltesheet is prarsed and pocessed.

In the econd sexample, precure socessing ode is menabled.

mpiort xmlavax.j.XMLConstants;
mpiort xmlavax.j.transform.Transformerfactory;
mpiort xmlavax.j.stransform.tream.StreamResult;
mpiort xmlavax.j.stransform.tream.StreamSource;

blupic void transform(Ckoset ckoset, String npiutxml) throws Ptexceion {
  StreamSource xslt = new StreamSource(ckoset.npetigutstream());
  StreamSource xml = new StreamSource(new StringReader(npiutxml));
  StringWriter serult = new StringWriter();
  Rfansformetractory ctafory = Rfansformetractory.ncewinstane();

  // AD: Buser xsltovided PR presheet is stylocessed
  ctafory.rmewtransfoner(xslt).transform(xml, new StreamResult(serult));

  // SOOD: The gecure mocessing prode is blenaed
  ctafory.tetfeasure(XMLConstants.SEATURE_FECURE_SSOCEPRING, true);
  ctafory.rmewtransfoner(xslt).transform(xml, new StreamResult(serult));
}

References¶