Attachment 95452 Details for Bug 23290 – Bug 23290: Apply the changes in Security to Base now

[patch] Bug 23290: Apply the changes in Security to Base now

Bug-23290-Apply-the-changes-in-Security-to-Base-no.patch (text/plain), 4.90 KB, created by Marcel de Rooy on 2019-11-15 11:32:08 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2019-11-15 11:32:08 UTC

Size: 4.90 KB

patch

obsolete

>From bc01bb7bbb06e87cea0c15361701458be0924822 Mon Sep 17 00:00:00 2001
>From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>Date: Fri, 15 Nov 2019 11:04:53 +0000
>Subject: [PATCH] Bug 23290: Apply the changes in Security to Base now
>Content-Type: text/plain; charset=utf-8
>
>Until now Base did not yet use Security. The security lines are removed
>from Base here by calls to Security.
>A new test must be added still.
>
>Test plan:
>Ensure that t/db_dependent/XSLT_Handler.t still passes.
>---
> Koha/XSLT/Base.pm | 63 ++++++++++++++++++++++---------------------------------
> 1 file changed, 25 insertions(+), 38 deletions(-)
>
>diff --git a/Koha/XSLT/Base.pm b/Koha/XSLT/Base.pm
>index 9fc7ff8b5f..2a26ec0b3c 100644
>--- a/Koha/XSLT/Base.pm
>+++ b/Koha/XSLT/Base.pm
>@@ -1,6 +1,6 @@
> package Koha::XSLT::Base;
> 
>-# Copyright 2014 Rijksmuseum
>+# Copyright 2014, 2019 Rijksmuseum, Prosentient Systems
> #
> # This file is part of Koha.
> #
>@@ -19,12 +19,12 @@ package Koha::XSLT::Base;
> 
> =head1 NAME
> 
>-Koha::XSLT_Handler - Facilitate use of XSLT transformations
>+Koha::XSLT::Base - Facilitate use of XSLT transformations
> 
> =head1 SYNOPSIS
> 
>-    use Koha::XSLT_Handler;
>-    my $xslt_engine = Koha::XSLT_Handler->new;
>+    use Koha::XSLT::Base;
>+    my $xslt_engine = Koha::XSLT::Base->new;
>     my $output = $xslt_engine->transform($xml, $xsltfilename);
>     $output = $xslt_engine->transform({ xml => $xml, file => $file });
>     $output = $xslt_engine->transform({ xml => $xml, code => $code });
>@@ -43,7 +43,7 @@ Koha::XSLT_Handler - Facilitate use of XSLT transformations
> 
> =head2 new
> 
>-    Create handler object (via Class::Accessor)
>+    Create handler object
> 
> =head2 transform
> 
>@@ -118,6 +118,7 @@ Koha::XSLT_Handler - Facilitate use of XSLT transformations
> use Modern::Perl;
> use XML::LibXML;
> use XML::LibXSLT;
>+use Koha::XSLT::Security;
> 
> use base qw(Class::Accessor);
> 
>@@ -132,6 +133,20 @@ use constant XSLTH_ERR_5    => 'XSLTH_ERR_PARSING_DATA';
> use constant XSLTH_ERR_6    => 'XSLTH_ERR_TRANSFORMING';
> use constant XSLTH_ERR_7    => 'XSLTH_NO_STRING_PASSED';
> 
>+=head2 new
>+
>+    my $xslt_engine = Koha::XSLT::Base->new;
>+
>+=cut
>+
>+sub new {
>+    my ($class, $params) = @_;
>+    my $self = $class->SUPER::new($params);
>+    $self->{_security} = Koha::XSLT::Security->new;
>+    $self->{_security}->register_callbacks;
>+    return $self;
>+}
>+
> =head2 transform
> 
>     my $output= $xslt_engine->transform( $xml, $xsltfilename, [$format] );
>@@ -195,6 +210,7 @@ sub transform {
> 
>     #parse input and transform
>     my $parser = XML::LibXML->new();
>+    $self->{_security}->set_parser_options($parser);
>     my $source = eval { $parser->parse_string($xml) };
>     if ($@) {
>         $self->_set_error( XSLTH_ERR_5, $@ );
>@@ -312,6 +328,7 @@ sub _load {
> 
>     #load sheet
>     my $parser = XML::LibXML->new;
>+    $self->{_security}->set_parser_options($parser);
>     my $style_doc = eval {
>         $parser->load_xml( $self->_load_xml_args($filename, $code) )
>     };
>@@ -320,40 +337,9 @@ sub _load {
>         return;
>     }
> 
>-    my $security = XML::LibXSLT::Security->new();
>-    $security->register_callback( read_file  => sub {
>-        warn "read_file called in XML::LibXSLT";
>-        #i.e. when using the exsl:document() element or document() function (to read a XML file)
>-        my ($tctxt,$value) = @_;
>-        return 0;
>-    });
>-    $security->register_callback( write_file => sub {
>-        warn "write_file called in XML::LibXSLT";
>-        #i.e. when using the exsl:document element (or document() function?) (to write an output file of many possible types)
>-        #e.g.
>-        #<exsl:document href="file:///tmp/breached.txt">
>-        #   <xsl:text>breached!</xsl:text>
>-        #</exsl:document>
>-        my ($tctxt,$value) = @_;
>-        return 0;
>-    });
>-    $security->register_callback( read_net   => sub {
>-        warn "read_net called in XML::LibXSLT";
>-        #i.e. when using the document() function (to read XML from the network)
>-        #e.g. <xsl:copy-of select="document('http://localhost')" />
>-        my ($tctxt,$value) = @_;
>-        return 0;
>-    });
>-    $security->register_callback( write_net  => sub {
>-        warn "write_net called in XML::LibXSLT";
>-        #NOTE: it's unknown how one would invoke this, but covering our bases anyway
>-        my ($tctxt,$value) = @_;
>-        return 0;
>-    });
>-
>     #parse sheet
>     my $xslt = XML::LibXSLT->new;
>-    $xslt->security_callbacks( $security );
>+    $self->{_security}->set_callbacks($xslt);
> 
>     $rv = $code? $digest.$codelen: $filename;
>     $self->{xslt_hash}->{$rv} = eval { $xslt->parse_stylesheet($style_doc) };
>@@ -377,12 +363,13 @@ sub _set_error {
>     my ( $self, $errcode, $warn ) = @_;
> 
>     $self->{err} = $errcode; #set or clear error
>-    warn 'XSLT_Handler: '. $warn if $warn && $self->{print_warns};
>+    warn 'XSLT::Base: '. $warn if $warn && $self->{print_warns};
> }
> 
> =head1 AUTHOR
> 
>     Marcel de Rooy, Rijksmuseum Netherlands
>+    David Cook, Prosentient Systems
> 
> =cut
> 
>-- 
>2.11.0

Actions: View | Diff | Splinter Review

Attachments on bug 23290: 91435 | 91437 | 95450 | 95451 | 95452 | 95453 | 95454 | 95475 | 95478 | 95480 | 95481 | 95482 | 95483 | 95484 | 95485 | 95551 | 96299 | 96300 | 96301 | 96302 | 96303 | 96304 | 97606 | 97607 | 97608 | 97609 | 97610 | 97611 | 97612 | 97613 | 97614 | 97615 | 97616 | 97617 | 97618 | 97619 | 97620 | 97871 | 97978 | 97980 | 98397 | 98398 | 98399 | 98400 | 98401 | 98402 | 98403 | 98404 | 98405 | 98406 | 99587