SecureXMLFilter.java

/*
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *      https://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.apache.commons.xml.secure;

import java.io.IOException;
import java.util.Objects;

import javax.xml.parsers.FactoryConfigurationError;
import javax.xml.transform.ErrorListener;
import javax.xml.transform.SourceLocator;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerException;
import javax.xml.transform.sax.SAXResult;
import javax.xml.transform.sax.SAXSource;

import org.xml.sax.ContentHandler;
import org.xml.sax.InputSource;
import org.xml.sax.SAXException;
import org.xml.sax.SAXParseException;
import org.xml.sax.XMLFilter;
import org.xml.sax.XMLReader;
import org.xml.sax.ext.LexicalHandler;
import org.xml.sax.helpers.XMLFilterImpl;

/**
 * {@link XMLFilter} that transforms the parsed input through a {@link SecureTemplates} and emits the result as SAX events.
 *
 * <p>Composed from the library's own wrappers instead of delegating to the implementation's filter, because the implementation filters self-provision an
 * unsecured reader for the input (the stock JDK's does so as early as {@code setContentHandler}) and cast a supplied {@link javax.xml.transform.Templates} to
 * their own type, which a wrapped Templates is not. Here the input is parsed by the parent reader, a secure one installed on first {@code parse} when the
 * caller has not set a parent (a caller-set parent is trusted configuration, used as-is), and the transformation runs on a {@link SecureTransformer}, so
 * runtime {@code document()} sits on the resolver floor. The filter is also the transformer's {@link ErrorListener}, forwarding TrAX error reports to the
 * caller-set {@link org.xml.sax.ErrorHandler} the way the parent reader's SAX reports are.</p>
 */
final class SecureXMLFilter extends XMLFilterImpl implements ErrorListener {

    /**
     * Bridges a TrAX report to the SAX callback shape.
     *
     * @param e the reported exception.
     * @return The original {@link SAXParseException} where one is the cause, otherwise a synthetic one carrying the locator.
     */
    private static SAXParseException toSAXParseException(final TransformerException e) {
        final Throwable cause = e.getCause();
        if (cause instanceof SAXParseException) {
            return (SAXParseException) cause;
        }
        // Embed the cause rather than the TrAX wrapper, so the originating exception stays directly reachable in the reported chain.
        final Exception embedded = cause instanceof Exception ? (Exception) cause : e;
        final SourceLocator locator = e.getLocator();
        return locator == null
                ? new SAXParseException(e.getMessage(), null, null, -1, -1, embedded)
                : new SAXParseException(e.getMessage(), locator.getPublicId(), locator.getSystemId(), locator.getLineNumber(), locator.getColumnNumber(), embedded);
    }

    private final SecureTemplates templates;

    /**
     * Constructs a new instance.
     *
     * @param templates the delegate to wrap; must not be {@code null}.
     * @throws NullPointerException if {@code delegate} is {@code null}.
     */
    SecureXMLFilter(final SecureTemplates templates) {
        this.templates = Objects.requireNonNull(templates, "templates");
    }

    /**
     * Forwards a recoverable transformation error to the caller-set {@link org.xml.sax.ErrorHandler}, mirroring the SAX contract: the transformation continues
     * unless that handler throws.
     */
    @Override
    public void error(final TransformerException e) throws TransformerException {
        try {
            error(toSAXParseException(e));
        } catch (final SAXException se) {
            throw new TransformerException(se);
        }
    }

    /**
     * Forwards a fatal transformation error to the caller-set {@link org.xml.sax.ErrorHandler}, then fails the parse like a SAX parser does after
     * {@code fatalError}: some implementations' lenient default listeners would otherwise only print and truncate the parse silently.
     */
    @Override
    public void fatalError(final TransformerException e) throws TransformerException {
        try {
            fatalError(toSAXParseException(e));
        } catch (final SAXException se) {
            throw new TransformerException(se);
        }
        throw e;
    }

    /**
     * {@inheritDoc}
     *
     * @throws FactoryConfigurationError Thrown from a factory in case of a {@link java.util.ServiceConfigurationError service
     *                                   configuration error} or if the implementation is not available or cannot be instantiated.
     */
    @Override
    public void parse(final InputSource input) throws SAXException, IOException {
        final ContentHandler handler = getContentHandler();
        if (handler == null) {
            throw new SAXException("No ContentHandler set on the XMLFilter to receive the transformation result");
        }
        if (getParent() == null) {
            setParent(SecureSAXParserFactory.newXMLReader(templates.overrideDefaultParser));
        }
        final XMLReader parent = getParent();
        // Like XMLFilterImpl.setupParse, minus the ContentHandler: the transformer owns the parent's content events and delivers the transformed stream to
        // the caller's handler through the SAXResult instead.
        parent.setEntityResolver(this);
        parent.setDTDHandler(this);
        parent.setErrorHandler(this);
        final SAXResult result = new SAXResult(handler);
        if (handler instanceof LexicalHandler) {
            result.setLexicalHandler((LexicalHandler) handler);
        }
        try {
            // A new SecureTransformer per parse: the floor is installed on it, and transformers are not reusable across concurrent parses.
            final Transformer transformer = templates.newTransformer();
            // The filter is the listener, so TrAX error reports reach the caller-set ErrorHandler like the parent reader's SAX reports do.
            transformer.setErrorListener(this);
            transformer.transform(new SAXSource(parent, input), result);
        } catch (final TransformerException e) {
            // The parent reader's parse errors and the handler's own exceptions arrive wrapped; rethrow the original rather than nesting the hierarchies.
            final Throwable cause = e.getCause();
            if (cause instanceof SAXException) {
                throw (SAXException) cause;
            }
            if (cause instanceof IOException) {
                throw (IOException) cause;
            }
            throw new SAXException(e);
        }
    }

    /** Forwards a transformation warning to the caller-set {@link org.xml.sax.ErrorHandler}; the transformation continues unless that handler throws. */
    @Override
    public void warning(final TransformerException e) throws TransformerException {
        try {
            warning(toSAXParseException(e));
        } catch (final SAXException se) {
            throw new TransformerException(se);
        }
    }
}