Set secure parameter for xslt transformation

veraPDF · Mar 18, 2024 · 9386ecb · 9386ecb
1 parent 614ffa4
commit 9386ecb
Show file tree

Hide file tree

Showing 3 changed files with 27 additions and 30 deletions.
diff --git a/core/src/main/java/org/verapdf/policy/PolicyChecker.java b/core/src/main/java/org/verapdf/policy/PolicyChecker.java
@@ -42,7 +42,7 @@ public final class PolicyChecker {
 
 	private static final Logger LOGGER = Logger.getLogger(PolicyChecker.class.getCanonicalName());
 
-	private static final TransformerFactory factory = TransformerFactory.newInstance();
+	private static final TransformerFactory factory = getTransformerFactory();
 	public static final String SCHEMA_EXT = "sch"; //$NON-NLS-1$
 	public static final String XSL_EXT = "xsl"; //$NON-NLS-1$
 	public static final String XSLT_EXT = "xslt"; //$NON-NLS-1$
@@ -63,15 +63,6 @@ public final class PolicyChecker {
 	private static final String mergeXsl = resourcePath + "MergeMrrPolicy" + '.' + XSL_EXT; //$NON-NLS-1$
 	private static final Templates cachedMergeXsl = SchematronPipeline.createCachedTransform(mergeXsl);
 
-	static {
-		try {
-			factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
-			factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "file");
-		} catch (TransformerConfigurationException ignored) {
-			LOGGER.log(Level.WARNING, "Unable to secure xsl transformer");
-		}
-	}
-
 	private PolicyChecker() {
 
 	}
@@ -97,6 +88,7 @@ public static void insertPolicyReport(final File policyReport, final File mrrRep
 			Transformer transformer = cachedMergeXsl.newTransformer();
 			transformer.setParameter("policyResultPath", policyReport.getAbsolutePath()); //$NON-NLS-1$
 			transformer.transform(new StreamSource(mrrReport), new StreamResult(mergedReport));
+			return;
 		} catch (TransformerException excep) {
 			throw new VeraPDFException("Problem merging XML files.", excep); //$NON-NLS-1$
 		}
@@ -215,4 +207,15 @@ private static void applySchematronXsl(final InputStream schematronXsl, final In
 		Transformer transformer = factory.newTransformer(new StreamSource(schematronXsl));
 		transformer.transform(new StreamSource(xmlReport), new StreamResult(policyReport));
 	}
+
+	private static TransformerFactory getTransformerFactory() {
+		TransformerFactory fact = TransformerFactory.newInstance();
+		try {
+			fact.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+			fact.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "file");
+		} catch (TransformerConfigurationException e) {
+			LOGGER.log(Level.WARNING, "Unable to secure xsl transformer");
+		}
+		return fact;
+	}
 }
diff --git a/core/src/main/java/org/verapdf/policy/SchematronPipeline.java b/core/src/main/java/org/verapdf/policy/SchematronPipeline.java
@@ -45,15 +45,6 @@ final class SchematronPipeline {
 	private static final Templates cachedExpXsl = createCachedTransform(isoExpXsl);
 	private static final Templates cachedIsoSvrlXsl = createCachedTransform(isoSvrlXsl);
 
-	static {
-		try {
-			factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
-			factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "file");
-		} catch (TransformerConfigurationException ignored) {
-			LOGGER.log(Level.WARNING, "Unable to secure xsl transformer");
-		}
-	}
-
 	private SchematronPipeline() {
 	}
 
@@ -97,7 +88,8 @@ private static TransformerFactory getTransformerFactory() {
 		try {
 			fact.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
 			fact.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "file");
-		} catch (TransformerConfigurationException ignored) {
+		} catch (TransformerConfigurationException e) {
+			LOGGER.log(Level.WARNING, "Unable to secure xsl transformer");
 		}
 		fact.setURIResolver(new ClasspathResourceURIResolver());
 		return fact;

diff --git a/core/src/main/java/org/verapdf/report/XsltTransformer.java b/core/src/main/java/org/verapdf/report/XsltTransformer.java
@@ -41,16 +41,7 @@ public final class XsltTransformer {
 
 	private static final Logger LOGGER = Logger.getLogger(XsltTransformer.class.getCanonicalName());
 
-	private static final TransformerFactory factory = TransformerFactory.newInstance();
-
-	static {
-		try {
-			factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
-			factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "file");
-		} catch (TransformerConfigurationException ignored) {
-			LOGGER.log(Level.WARNING, "Unable to secure xslt transformer");
-		}
-	}
+	private static final TransformerFactory factory = getTransformerFactory();
 
 	private XsltTransformer() {
 	}
@@ -84,4 +75,15 @@ public static void transform(InputStream source, InputStream xslt, PrintWriter d
 
 		transformer.transform(new StreamSource(source), new StreamResult(destination));
 	}
+
+	private static TransformerFactory getTransformerFactory() {
+		TransformerFactory fact = TransformerFactory.newInstance();
+		try {
+			fact.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+			fact.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "file");
+		} catch (TransformerConfigurationException e) {
+			LOGGER.log(Level.WARNING, "Unable to secure xsl transformer");
+		}
+		return fact;
+	}
 }