From bc01bb7bbb06e87cea0c15361701458be0924822 Mon Sep 17 00:00:00 2001
From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Date: Fri, 15 Nov 2019 11:04:53 +0000
Subject: [PATCH] Bug 23290: Apply the changes in Security to Base now
Content-Type: text/plain; charset=utf-8

Until now Base did not yet use Security. The security lines are removed
from Base here by calls to Security.
A new test must be added still.

Test plan:
Ensure that t/db_dependent/XSLT_Handler.t still passes.
---
 Koha/XSLT/Base.pm | 63 ++++++++++++++++++++++---------------------------------
 1 file changed, 25 insertions(+), 38 deletions(-)

diff --git a/Koha/XSLT/Base.pm b/Koha/XSLT/Base.pm
index 9fc7ff8b5f..2a26ec0b3c 100644
--- a/Koha/XSLT/Base.pm
+++ b/Koha/XSLT/Base.pm
@@ -1,6 +1,6 @@
 package Koha::XSLT::Base;
 
-# Copyright 2014 Rijksmuseum
+# Copyright 2014, 2019 Rijksmuseum, Prosentient Systems
 #
 # This file is part of Koha.
 #
@@ -19,12 +19,12 @@ package Koha::XSLT::Base;
 
 =head1 NAME
 
-Koha::XSLT_Handler - Facilitate use of XSLT transformations
+Koha::XSLT::Base - Facilitate use of XSLT transformations
 
 =head1 SYNOPSIS
 
-    use Koha::XSLT_Handler;
-    my $xslt_engine = Koha::XSLT_Handler->new;
+    use Koha::XSLT::Base;
+    my $xslt_engine = Koha::XSLT::Base->new;
     my $output = $xslt_engine->transform($xml, $xsltfilename);
     $output = $xslt_engine->transform({ xml => $xml, file => $file });
     $output = $xslt_engine->transform({ xml => $xml, code => $code });
@@ -43,7 +43,7 @@ Koha::XSLT_Handler - Facilitate use of XSLT transformations
 
 =head2 new
 
-    Create handler object (via Class::Accessor)
+    Create handler object
 
 =head2 transform
 
@@ -118,6 +118,7 @@ Koha::XSLT_Handler - Facilitate use of XSLT transformations
 use Modern::Perl;
 use XML::LibXML;
 use XML::LibXSLT;
+use Koha::XSLT::Security;
 
 use base qw(Class::Accessor);
 
@@ -132,6 +133,20 @@ use constant XSLTH_ERR_5    => 'XSLTH_ERR_PARSING_DATA';
 use constant XSLTH_ERR_6    => 'XSLTH_ERR_TRANSFORMING';
 use constant XSLTH_ERR_7    => 'XSLTH_NO_STRING_PASSED';
 
+=head2 new
+
+    my $xslt_engine = Koha::XSLT::Base->new;
+
+=cut
+
+sub new {
+    my ($class, $params) = @_;
+    my $self = $class->SUPER::new($params);
+    $self->{_security} = Koha::XSLT::Security->new;
+    $self->{_security}->register_callbacks;
+    return $self;
+}
+
 =head2 transform
 
     my $output= $xslt_engine->transform( $xml, $xsltfilename, [$format] );
@@ -195,6 +210,7 @@ sub transform {
 
     #parse input and transform
     my $parser = XML::LibXML->new();
+    $self->{_security}->set_parser_options($parser);
     my $source = eval { $parser->parse_string($xml) };
     if ($@) {
         $self->_set_error( XSLTH_ERR_5, $@ );
@@ -312,6 +328,7 @@ sub _load {
 
     #load sheet
     my $parser = XML::LibXML->new;
+    $self->{_security}->set_parser_options($parser);
     my $style_doc = eval {
         $parser->load_xml( $self->_load_xml_args($filename, $code) )
     };
@@ -320,40 +337,9 @@ sub _load {
         return;
     }
 
-    my $security = XML::LibXSLT::Security->new();
-    $security->register_callback( read_file  => sub {
-        warn "read_file called in XML::LibXSLT";
-        #i.e. when using the exsl:document() element or document() function (to read a XML file)
-        my ($tctxt,$value) = @_;
-        return 0;
-    });
-    $security->register_callback( write_file => sub {
-        warn "write_file called in XML::LibXSLT";
-        #i.e. when using the exsl:document element (or document() function?) (to write an output file of many possible types)
-        #e.g.
-        #<exsl:document href="file:///tmp/breached.txt">
-        #   <xsl:text>breached!</xsl:text>
-        #</exsl:document>
-        my ($tctxt,$value) = @_;
-        return 0;
-    });
-    $security->register_callback( read_net   => sub {
-        warn "read_net called in XML::LibXSLT";
-        #i.e. when using the document() function (to read XML from the network)
-        #e.g. <xsl:copy-of select="document('http://localhost')" />
-        my ($tctxt,$value) = @_;
-        return 0;
-    });
-    $security->register_callback( write_net  => sub {
-        warn "write_net called in XML::LibXSLT";
-        #NOTE: it's unknown how one would invoke this, but covering our bases anyway
-        my ($tctxt,$value) = @_;
-        return 0;
-    });
-
     #parse sheet
     my $xslt = XML::LibXSLT->new;
-    $xslt->security_callbacks( $security );
+    $self->{_security}->set_callbacks($xslt);
 
     $rv = $code? $digest.$codelen: $filename;
     $self->{xslt_hash}->{$rv} = eval { $xslt->parse_stylesheet($style_doc) };
@@ -377,12 +363,13 @@ sub _set_error {
     my ( $self, $errcode, $warn ) = @_;
 
     $self->{err} = $errcode; #set or clear error
-    warn 'XSLT_Handler: '. $warn if $warn && $self->{print_warns};
+    warn 'XSLT::Base: '. $warn if $warn && $self->{print_warns};
 }
 
 =head1 AUTHOR
 
     Marcel de Rooy, Rijksmuseum Netherlands
+    David Cook, Prosentient Systems
 
 =cut
 
-- 
2.11.0