3

I am generating a PDF document with XML file as input using Apache FOP 2.4. To prevent XXE-Attacks I need to set the secure processing feature (FEATURE_SECURE_PROCESSING) in TransformerFactory:

InputStream xslTransformer = getClass().getClassLoader().getResourceAsStream("foo.xsl");
TransformerFactory transformerFactory = TransformerFactory.newInstance();
transformerFactory.setFeature(FEATURE_SECURE_PROCESSING, true);
Transformer transformer = transformerFactory.newTransformer(new StreamSource(xslTransformer));
transformer.transform(new DOMSource(), new SAXResult(fop.getDefaultHandler()));

After setting this feature I can't generate any PDF document and I'm getting warnings:

SystemId Unknown; Line #49; Column #99; "master-name" attribute is not allowed on the fo:simple-page-master element!
SystemId Unknown; Line #49; Column #99; "initial-page-number" attribute is not allowed on the fo:simple-page-master element!
SystemId Unknown; Line #49; Column #99; "page-height" attribute is not allowed on the fo:simple-page-master element!
SystemId Unknown; Line #49; Column #99; "page-width" attribute is not allowed on the fo:simple-page-master element!
etc ...

Here is a section of XSL file (foo.xsl):

<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="2.0"
                xmlns:fo="http://www.w3.org/1999/XSL/Format"
                xmlns:pdf="http://xmlgraphics.apache.org/fop/extensions/pdf">

    <xsl:template match="/">
        <fo:root>
            <fo:layout-master-set>
                <fo:simple-page-master master-name="A4-portrait" initial-page-number="1"
                                       page-height="29.7cm" page-width="21.0cm" margin-top="0cm"
                                       margin-left="1cm" margin-right="1.3cm" margin-bottom="0cm">
                    <fo:region-body margin-top="2.2cm" margin-bottom="1.2cm" margin-left="1.3cm"/>
                    <fo:region-before region-name="xsl-region-before" extent="2.2cm"/>
                    <fo:region-after region-name="xsl-region-after" extent="1.2cm"/>
                    <fo:region-start region-name="xsl-region-start" extent="1.3cm"/>
                </fo:simple-page-master>
            </fo:layout-master-set>

            <fo:page-sequence master-reference="A4-portrait" font-family="Consolas" font-size="11">
                <fo:flow flow-name="xsl-region-body">
                    <fo:block linefeed-treatment="preserve" font-weight="bold">
                        foo
                    </fo:block>

                    <fo:block linefeed-treatment="preserve">
                        bar
                    </fo:block>

                </fo:flow>
            </fo:page-sequence>

        </fo:root>
    </xsl:template>

</xsl:stylesheet>

How should I use this feature and make it work? Java version is 8.

greggor
  • 33
  • 4
  • These are all FOP errors. But you didn't provide the input files creating this FOP file and therefore your question is not answerable in the current state. Please provide the input files (XML + XSLT or at least the XML-FO output file). – zx485 Nov 25 '19 at 11:40
  • I edited my post and provided an XSL input file. I think an XML file is not really necessery. If I'm wrong i can provide it too. – greggor Nov 25 '19 at 11:55
  • I checked you code with the definition of [fo:simple-page-master](http://www.datypic.com/sc/fo11/e-fo_simple-page-master.html) and except for `initial-page-number="1"`, it's all standard compliant. So, I guess, without the relevant part of the XML, I cannot replicate the error. – zx485 Nov 25 '19 at 13:20
  • XML input files can be these invoices: https://github.com/itplr-kosit/xrechnung-testsuite/tree/master/instances (or do You mean the FOP-Config XML?) I think my problem is the TransformerFactory that I use. When I change the implementing class, warnings disappear. Do you know, which implementation classes support this feature? – greggor Nov 25 '19 at 14:04
  • I tried to reproduce your error with the first XML file from your link. Then I applied the XSLT and after that Apache FOP. The result is a PDF file containing two strings: `foo` and `bar`. The chain appears to work, but the output seems to need some improvement. However, I cannot reproduce the errors. – zx485 Nov 25 '19 at 16:02
  • Could you please tell me, which implementation class of TransformerFactory did you use? The chain works for me too as long as I don't set the secure processing feature. Thank you for help anyway. – greggor Nov 26 '19 at 07:09
  • Actually, I did not use `TransformerFactory` at all. I just put the XML and the XSLT into an XSLT processor, and passed the result to _Apache FOP_ to transform it to a PDF file. Then I viewed the PDF using the standard PDF viewer of Ubuntu 18.04: `okular`. So, I used a different approach that's working as desired and made the point that your XML+XSLT seem to be OK. The problem must be somewhere else. – zx485 Nov 26 '19 at 08:22

1 Answers1

1

This is due to xalan-2.7.2.

Here is the bug in Xalan-J

Switching to xalan-2.7.1 or earlier will solve your problem.

You may have to force exclusions for xalan on an Apache-FO dependency.

You can also overwrite with 2.7.2_3, which patches this problem.

<dependency>
    <groupId>org.apache.servicemix.bundles</groupId>
    <artifactId>org.apache.servicemix.bundles.xalan</artifactId>
    <version>2.7.2_3</version><!--$NO-MVN-MAN-VER$-->
</dependency>

Use of <!--$NO-MVN-MAN-VER$--> prevents overrides.

Note: this bugfix was not migrated to xalan-2.7.3 for unspecified reasons and at this time there is no servicemix for 2.7.3 with the bugfix.

JoshDM
  • 4,939
  • 7
  • 43
  • 72