Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0024557Openbravo ERPA. Platformpublic2013-08-21 17:462013-08-22 08:16
Reportershuehner 
Assigned Toshuehner 
PriorityimmediateSeveritymajorReproducibilityhave not tried
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Version 
Target Version3.0MP27Fixed in Version3.0MP25 
Merge Request Status
Review Assigned ToAugustoMauch
OBNetwork customerNo
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0024557: Reconfigure xml-parser used by /ws/dal to disallow referencing external entities
DescriptionThe xerces xml parser used by Openbravo by default allowed referencing external entities defined in the xml-data being parsed by it.

As data processed by the code behind /ws/dal is untrusted by default as it is coming from external sources those features must be disabled.
Steps To Reproducesend an xml document using feature as described above to the xml-webservices.
Proposed SolutionReconfigure xml-parser to disallow those features in the /ws/dal endpoint.
Additional Information
TagsNo tags attached.
Relationships
blocks defect 00245563.0MP27 closed shuehner Reconfigure xml-parser used by /ws/dal to disallow referencing external entities 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2013-08-21 17:48shuehnerTypedefect => backport
2013-08-21 17:48shuehnerfix_in_branch => 2.50
2013-08-21 18:14shuehnerReview Assigned To => AugustoMauch
2013-08-21 19:34hgbotCheckin
2013-08-21 19:34hgbotNote Added: 0060721
2013-08-21 19:34hgbotStatusscheduled => resolved
2013-08-21 19:34hgbotResolutionopen => fixed
2013-08-21 19:34hgbotFixed in SCM revision => http://code.openbravo.com/erp/stable/2.50/rev/381dd8af30f95a03d3c40672f820317a4dd2ff0b [^]
2013-08-22 08:16AugustoMauchNote Added: 0060723
2013-08-22 08:16AugustoMauchStatusresolved => closed
2013-08-22 08:16AugustoMauchFixed in Version => 3.0MP25

Notes
(0060721)
hgbot   
2013-08-21 19:34   
Repository: erp/stable/2.50
Changeset: 381dd8af30f95a03d3c40672f820317a4dd2ff0b
Author: Stefan Hühner <stefan.huehner <at> openbravo.com>
Date: Wed Aug 21 17:53:54 2013 +0200
URL: http://code.openbravo.com/erp/stable/2.50/rev/381dd8af30f95a03d3c40672f820317a4dd2ff0b [^]

Fixed 24557. Disallow referencing external entities in /ws/dal/
Reconfigure the xml-parser used behind /ws/dal to not accept
external entity references as the xml data is coming from outside
Openbravo.

---
M src/org/openbravo/service/rest/DalWebService.java
---
(0060723)
AugustoMauch   
2013-08-22 08:16   
Code reviewed and verified in pi@b975d72dec38