From 29d9942d5266a4decc9804e3304bd0514c8027d4 Mon Sep 17 00:00:00 2001
From: Christine Poerschke <cpoerschke@apache.org>
Date: Fri, 13 Oct 2017 12:46:58 +0100
Subject: [PATCH] SOLR-11477: Disallow resolving of external entities in Lucene

---
 .../apache/lucene/queryparser/xml/CoreParser.java  | 65 +++++++++++++++++++---
 1 file changed, 56 insertions(+), 9 deletions(-)

diff --git a/queryparser/src/java/org/apache/lucene/queryparser/xml/CoreParser.java b/queryparser/src/java/org/apache/lucene/queryparser/xml/CoreParser.java
index 02ac8b9..ac40779 100644
--- a/queryparser/src/java/org/apache/lucene/queryparser/xml/CoreParser.java
+++ b/queryparser/src/java/org/apache/lucene/queryparser/xml/CoreParser.java
@@ -6,10 +6,18 @@ import org.apache.lucene.queryparser.xml.builders.*;
 import org.apache.lucene.search.Query;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
+import org.xml.sax.EntityResolver;
+import org.xml.sax.ErrorHandler;
+import org.xml.sax.InputSource;
+import org.xml.sax.SAXException;
 
+
+import javax.xml.XMLConstants;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
 import java.io.InputStream;
+import java.util.Locale;
 
 /*
  * Licensed to the Apache Software Foundation (ASF) under one or more
@@ -118,6 +126,10 @@ public class CoreParser implements QueryBuilder {
     queryFactory.addBuilder("SpanNot", snot);
   }
 
+  /**
+   * Parses the given stream as XML file and returns a {@link Query}.
+   * By default this disallows external entities for security reasons.
+   */
   public Query parse(InputStream xmlStream) throws ParserException {
     return getQuery(parseXML(xmlStream).getDocumentElement());
   }
@@ -130,23 +142,48 @@ public class CoreParser implements QueryBuilder {
     filterFactory.addBuilder(nodeName, builder);
   }
 
-  private static Document parseXML(InputStream pXmlFile) throws ParserException {
-    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
-    DocumentBuilder db = null;
+  /**
+   * Returns a SAX {@link EntityResolver} to be used by {@link DocumentBuilder}.
+   * By default this returns {@link #DISALLOW_EXTERNAL_ENTITY_RESOLVER}, which disallows the
+   * expansion of external entities (for security reasons). To restore legacy behavior,
+   * override this method to return {@code null}.
+   */
+  protected EntityResolver getEntityResolver() {
+    return DISALLOW_EXTERNAL_ENTITY_RESOLVER;
+  }
+
+  /**
+   * Subclass and override to return a SAX {@link ErrorHandler} to be used by {@link DocumentBuilder}.
+   * By default this returns {@code null} so no error handler is used.
+   * This method can be used to redirect XML parse errors/warnings to a custom logger.
+   */
+  protected ErrorHandler getErrorHandler() {
+    return null;
+  }
+
+  private Document parseXML(InputStream pXmlFile) throws ParserException {
+    final DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+    dbf.setValidating(false);
     try {
-      db = dbf.newDocumentBuilder();
+      dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+    } catch (ParserConfigurationException e) {
+      // ignore since all implementations are required to support the
+      // {@link javax.xml.XMLConstants#FEATURE_SECURE_PROCESSING} feature
     }
-    catch (Exception se) {
-      throw new ParserException("XML Parser configuration error", se);
+    final DocumentBuilder db;
+    try {
+        db = dbf.newDocumentBuilder();
+    } catch (Exception se) {
+        throw new ParserException("XML Parser configuration error.", se);
     }
-    org.w3c.dom.Document doc = null;
     try {
-      doc = db.parse(pXmlFile);
+      db.setEntityResolver(getEntityResolver());
+      db.setErrorHandler(getErrorHandler());
+      return db.parse(pXmlFile);
     }
     catch (Exception se) {
       throw new ParserException("Error parsing XML stream:" + se, se);
     }
-    return doc;
   }
 
 
@@ -154,4 +191,14 @@ public class CoreParser implements QueryBuilder {
   public Query getQuery(Element e) throws ParserException {
     return queryFactory.getQuery(e);
   }
+
+  public static final EntityResolver DISALLOW_EXTERNAL_ENTITY_RESOLVER = new EntityResolver() {
+    @Override
+    public InputSource resolveEntity(String publicId, String systemId) throws SAXException {
+      throw new SAXException(String.format(Locale.ENGLISH,
+            "External Entity resolving unsupported:  publicId=\"%s\" systemId=\"%s\"",
+            publicId, systemId));
+    }
+  };
+
 }
-- 
2.13.6