Openbravo Issue Tracking System - Openbravo ERP
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0049052Openbravo ERPA. Platformpublic2022-04-12 12:272022-04-26 14:27
Reporterfermin_ostivar 
Assigned ToAugustoMauch 
PriorityimmediateSeveritycriticalReproducibilityalways
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Versionpi 
Target VersionPR22Q1.2Fixed in VersionPR22Q1.2 
Merge Request Status
Review Assigned To
OBNetwork customer
Web browser
ModulesCore
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0049052: XML parsers XXE attacks vulnerabilty
DescriptionWe have detected a SaxParser vulnerable to XXE attach in the class TranslationManager

      final SAXParserFactory factory = SAXParserFactory.newInstance();
      final SAXParser parser = factory.newSAXParser();
      parser.parse(in, handler);


https://gitlab.com/openbravo/product/openbravo/-/blob/master/src/org/openbravo/erpCommon/ad_forms/TranslationManager.java#L641 [^]
https://gitlab.com/openbravo/product/openbravo/-/blob/master/src/org/openbravo/erpCommon/ad_forms/TranslationManager.java#L666 [^]
Steps To ReproduceN/A
Proposed SolutionTo create a new get method in the class XMLUtil.java as newSAXReader and to call it in the lines reported previously
Additional Information
TagsNo tags attached.
Relationships
blocks design defect 0049039 closed AugustoMauch XML parsers XXE attacks vulnerabilty 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2022-04-13 13:24AugustoMauchTypedesign defect => backport
2022-04-13 13:24AugustoMauchTarget Version => PR22Q1.2
2022-04-25 17:09hgbotNote Added: 0136726
2022-04-26 14:27hgbotResolutionopen => fixed
2022-04-26 14:27hgbotStatusscheduled => closed
2022-04-26 14:27hgbotNote Added: 0136759
2022-04-26 14:27hgbotFixed in Version => PR22Q1.2
2022-04-26 14:27hgbotNote Added: 0136760

Notes
(0136726)
hgbot   
2022-04-25 17:09   
Merge Request created: https://gitlab.com/openbravo/product/openbravo/-/merge_requests/568 [^]
(0136759)
hgbot   
2022-04-26 14:27   
Merge request merged: https://gitlab.com/openbravo/product/openbravo/-/merge_requests/568 [^]
(0136760)
hgbot   
2022-04-26 14:27   
Directly closing issue as related merge request is already approved.

Repository: https://gitlab.com/openbravo/product/openbravo [^]
Changeset: dde64a620cae5e31b581586aad4532aa03d0b04a
Author: Augusto Mauch <augusto.mauch@openbravo.com>
Date: 26-04-2022 11:35:40
URL: https://gitlab.com/openbravo/product/openbravo/-/commit/dde64a620cae5e31b581586aad4532aa03d0b04a [^]

Fixes ISSUE-49052: Provides a safe way to create instances of SAXParser

A new method has been created in XMLUtil to create instances of SAXParser that are not vulnerable to XXE attacks

---
M src/org/openbravo/dal/xml/XMLUtil.java
M src/org/openbravo/erpCommon/ad_forms/TranslationManager.java
---