fix: secure processing of document transformation to prevent XSLT injection

[rng70-or]

Motivation

In file: Configuration.java, there is a method updateConfigFile that transforms documents that come from an external source without proper validation and also there is a method createConfigProperty that transforms documents that come from an external source without proper validation. This may allow an attacker to execute malicious code or read sensitive file. To prevent/minimize the overall impact, when processing to any type of document secure processing should be enabled

    secureFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
    secureFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
    secureFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");

Sponsorship and Support

This work is done by the security researchers from OpenRefactory and is supported by the Open Source Security Foundation (OpenSSF): Project Alpha-Omega. Alpha-Omega is a project partnering with open source software project maintainers to systematically find new, as-yet-undiscovered vulnerabilities in open source code - and get them fixed – to improve global software supply chain security.

The bug is found by running the Intelligent Code Repair (iCR) tool by OpenRefactory and then manually triaging the results.