From 80c03149a8255e25d727cba1410703378b4d07fe Mon Sep 17 00:00:00 2001
From: Christine Poerschke <cpoerschke@apache.org>
Date: Fri, 13 Oct 2017 12:46:58 +0100
Subject: [PATCH] SOLR-11477: Disallow resolving of external entities in Lucene

---
 .../apache/lucene/queryparser/xml/CoreParser.java  | 64 +++++++++++++++++++---
 1 file changed, 55 insertions(+), 9 deletions(-)

diff --git a/lucene/queryparser/src/java/org/apache/lucene/queryparser/xml/CoreParser.java b/lucene/queryparser/src/java/org/apache/lucene/queryparser/xml/CoreParser.java
index d44fe02..dda9242 100644
--- a/lucene/queryparser/src/java/org/apache/lucene/queryparser/xml/CoreParser.java
+++ b/lucene/queryparser/src/java/org/apache/lucene/queryparser/xml/CoreParser.java
@@ -22,11 +22,18 @@ import org.apache.lucene.queryparser.xml.builders.*;
 import org.apache.lucene.search.Query;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
+import org.xml.sax.EntityResolver;
+import org.xml.sax.ErrorHandler;
+import org.xml.sax.InputSource;
+import org.xml.sax.SAXException;
 
+import javax.xml.XMLConstants;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
 
 import java.io.InputStream;
+import java.util.Locale;
 
 /**
  * Assembles a QueryBuilder which uses only core Lucene Query objects
@@ -118,6 +125,10 @@ public class CoreParser implements QueryBuilder {
     queryFactory.addBuilder("SpanNot", snot);
   }
 
+  /**
+   * Parses the given stream as XML file and returns a {@link Query}.
+   * By default this disallows external entities for security reasons.
+   */
   public Query parse(InputStream xmlStream) throws ParserException {
     return getQuery(parseXML(xmlStream).getDocumentElement());
   }
@@ -130,23 +141,48 @@ public class CoreParser implements QueryBuilder {
     filterFactory.addBuilder(nodeName, builder);
   }
 
-  private static Document parseXML(InputStream pXmlFile) throws ParserException {
-    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
-    DocumentBuilder db = null;
+  /**
+   * Returns a SAX {@link EntityResolver} to be used by {@link DocumentBuilder}.
+   * By default this returns {@link #DISALLOW_EXTERNAL_ENTITY_RESOLVER}, which disallows the
+   * expansion of external entities (for security reasons). To restore legacy behavior,
+   * override this method to return {@code null}.
+   */
+  protected EntityResolver getEntityResolver() {
+    return DISALLOW_EXTERNAL_ENTITY_RESOLVER;
+  }
+
+  /**
+   * Subclass and override to return a SAX {@link ErrorHandler} to be used by {@link DocumentBuilder}.
+   * By default this returns {@code null} so no error handler is used.
+   * This method can be used to redirect XML parse errors/warnings to a custom logger.
+   */
+  protected ErrorHandler getErrorHandler() {
+    return null;
+  }
+
+  private Document parseXML(InputStream pXmlFile) throws ParserException {
+    final DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+    dbf.setValidating(false);
     try {
-      db = dbf.newDocumentBuilder();
+      dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+    } catch (ParserConfigurationException e) {
+      // ignore since all implementations are required to support the
+      // {@link javax.xml.XMLConstants#FEATURE_SECURE_PROCESSING} feature
     }
-    catch (Exception se) {
-      throw new ParserException("XML Parser configuration error", se);
+    final DocumentBuilder db;
+    try {
+        db = dbf.newDocumentBuilder();
+    } catch (Exception se) {
+        throw new ParserException("XML Parser configuration error.", se);
     }
-    org.w3c.dom.Document doc = null;
     try {
-      doc = db.parse(pXmlFile);
+      db.setEntityResolver(getEntityResolver());
+      db.setErrorHandler(getErrorHandler());
+      return db.parse(pXmlFile);
     }
     catch (Exception se) {
       throw new ParserException("Error parsing XML stream:" + se, se);
     }
-    return doc;
   }
 
 
@@ -154,4 +190,14 @@ public class CoreParser implements QueryBuilder {
   public Query getQuery(Element e) throws ParserException {
     return queryFactory.getQuery(e);
   }
+
+  public static final EntityResolver DISALLOW_EXTERNAL_ENTITY_RESOLVER = new EntityResolver() {
+    @Override
+    public InputSource resolveEntity(String publicId, String systemId) throws SAXException {
+      throw new SAXException(String.format(Locale.ENGLISH,
+            "External Entity resolving unsupported:  publicId=\"%s\" systemId=\"%s\"",
+            publicId, systemId));
+    }
+  };
+
 }
-- 
2.13.6