Prevent XML xxe on Strict HL7 parsing - #406
Draft
mgaffigan wants to merge 1 commit into
Draft
Conversation
Signed-off-by: Mitch Gaffigan <mitch.gaffigan@comcast.net>
Test Results677 tests 677 ✅ 2m 20s ⏱️ Results for commit dcb2781. |
jonbartels
requested changes
Aug 10, 2026
| boolean exceptionThrown = false; | ||
| try { | ||
| strictSerializer.toXML(xmlDisguisedAsHl7); | ||
| } catch (MessageSerializerException e) { |
Contributor
There was a problem hiding this comment.
Should this specifically inspect the exception message and cause? That way it validates it threw because of the XML parsing and not because of some other serialization fault.
What is the output of this test before and after the other code changes?
|
|
||
| @Test | ||
| public void testToXmlWithStrictParserAllowsXmlInputWhenOptedIn() throws Exception { | ||
| String xmlDisguisedAsHl7 = "<foo><bar>notreallyhl7</bar></foo>"; |
Contributor
There was a problem hiding this comment.
Refactor this to a constant since its used in multiple tests
| Message message = null; | ||
| source = source.trim(); | ||
|
|
||
| if (source.length() > 0 && source.charAt(0) == '<') { |
Contributor
There was a problem hiding this comment.
Non-blocking - How can this be documented in the release notes?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Avoids any possibility of XXE by not accepting XML input on a channel to receive HL7. Turns the message into an error - just as it would be for any other invalid format.
Breaking change for anyone relying on being able to send XML to a channel configured to receive HL7. Opt-out of the new behavior by toggling "Allow XML" in the datatype properties.
Thanks to Samuel Paschuan for reporting the issue.