Skip to content

Improve security and configurability of functions that access the Environment and System Properties #4452

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
adamretter wants to merge 11 commits into
base: develop
Choose a base branch
from
Draft

Improve security and configurability of functions that access the Environment and System Properties #4452

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
a6b551a
[ignore] Reformat code
adamretter Jun 21, 2022
614b5ef
[ignore] Fix Typo
adamretter Jun 21, 2022
21c5f6b
[bugfix] fn:available-environment-variables and fn:environment-variab…
adamretter Jun 21, 2022
27040ca
[bugfix] Make thread-safe
adamretter Jun 21, 2022
f3847e1
[refactor] Rename class to ExistSystemProperties to make it clear the…
adamretter Jun 21, 2022
b1f1abd
[refactor] Use constants for eXist-db System Properties
adamretter Jun 21, 2022
e5ead3a
[bugfix] util:system-property should be deterministic within the exec…
adamretter Jun 21, 2022
4d6d46a
[feature] Add the function util:available-system-properties#0
adamretter Jun 21, 2022
475cab8
[feature] Allow access to specific Environment Variables when using f…
adamretter Jun 21, 2022
cc67d13
[feature] Allow access to specific Java System Properties when using …
adamretter Jun 21, 2022
7c2c499
[bugfix] Adjust test for Windows
adamretter Jun 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
[ignore] Reformat code
  • Loading branch information
@adamretter
adamretter committed Aug 3, 2022
commit a6b551a674b56443004423825e976341180fb669
41 changes: 21 additions & 20 deletions exist-core/src/main/java/org/exist/xquery/functions/fn/FunEnvironment.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
package org.exist.xquery.functions.fn;

import java.util.Map;

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.exist.dom.QName;
Expand All @@ -41,29 +42,29 @@

public class FunEnvironment extends BasicFunction {

protected static final Logger logger = LogManager.getLogger(FunEnvironment.class);
private static final Logger LOGGER = LogManager.getLogger(FunEnvironment.class);

public final static FunctionSignature[] signature = {
new FunctionSignature(
new QName("available-environment-variables", Function.BUILTIN_FUNCTION_NS),
"Returns a list of environment variable names.",
null,
new FunctionReturnSequenceType(Type.STRING, Cardinality.ZERO_OR_MORE,
"Returns a sequence of strings, being the names of the environment variables. User must be DBA.")
),
new FunctionSignature(
new QName("environment-variable", Function.BUILTIN_FUNCTION_NS),
"Returns the value of a system environment variable, if it exists.",
new SequenceType[] {
new FunctionParameterSequenceType("name", Type.STRING,
Cardinality.EXACTLY_ONE, "Name of environment variable.")
},
new FunctionReturnSequenceType(Type.STRING, Cardinality.ZERO_OR_ONE, "Corrensponding value of the environment variable, "
+ "if there is no environment variable with a matching name, the function returns the empty sequence. User must be DBA.")
)
new FunctionSignature(
new QName("available-environment-variables", Function.BUILTIN_FUNCTION_NS),
"Returns a list of environment variable names.",
null,
new FunctionReturnSequenceType(Type.STRING, Cardinality.ZERO_OR_MORE,
"Returns a sequence of strings, being the names of the environment variables. User must be DBA.")
),
new FunctionSignature(
new QName("environment-variable", Function.BUILTIN_FUNCTION_NS),
"Returns the value of a system environment variable, if it exists.",
new SequenceType[]{
new FunctionParameterSequenceType("name", Type.STRING,
Cardinality.EXACTLY_ONE, "Name of environment variable.")
},
new FunctionReturnSequenceType(Type.STRING, Cardinality.ZERO_OR_ONE, "Corrensponding value of the environment variable, "
+ "if there is no environment variable with a matching name, the function returns the empty sequence. User must be DBA.")
)
};

public FunEnvironment(XQueryContext context, FunctionSignature signature) {
public FunEnvironment(final XQueryContext context, final FunctionSignature signature) {
super(context, signature);
}

Expand All @@ -72,7 +73,7 @@ public Sequence eval(Sequence[] args, Sequence contextSequence) throws XPathExce

if (!context.getSubject().hasDbaRole()) {
final String txt = "Permission denied, calling user '" + context.getSubject().getName() + "' must be a DBA to call this function.";
logger.error(txt);
LOGGER.error(txt);
return Sequence.EMPTY_SEQUENCE;
}

Expand Down
40 changes: 17 additions & 23 deletions exist-core/src/main/java/org/exist/xquery/functions/util/SystemProperty.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,51 +22,45 @@
package org.exist.xquery.functions.util;

import org.exist.SystemProperties;
import org.exist.dom.QName;
import org.exist.xquery.BasicFunction;
import org.exist.xquery.Cardinality;
import org.exist.xquery.FunctionSignature;
import org.exist.xquery.XPathException;
import org.exist.xquery.XQueryContext;
import org.exist.xquery.value.FunctionParameterSequenceType;
import org.exist.xquery.value.FunctionReturnSequenceType;
import org.exist.xquery.value.Sequence;
import org.exist.xquery.value.SequenceType;
import org.exist.xquery.value.StringValue;
import org.exist.xquery.value.Type;

import static org.exist.xquery.FunctionDSL.param;
import static org.exist.xquery.FunctionDSL.returnsOpt;
import static org.exist.xquery.functions.util.UtilModule.functionSignature;

/**
* Libary function to retrieve the value of a system property.
* Library function to retrieve the value of a system property.
*
* @author Wolfgang Meier
* @author Loren Cahlander
*/
public class SystemProperty extends BasicFunction {

public final static FunctionSignature signature = new FunctionSignature(
new QName("system-property", UtilModule.NAMESPACE_URI, UtilModule.PREFIX),
"Returns the value of a system property. Similar to the corresponding XSLT function. " +
"Predefined properties are: vendor, vendor-url, product-name, product-version, product-build, and all Java " +
"system properties.",
new SequenceType[] {
new FunctionParameterSequenceType("property-name", Type.STRING, Cardinality.EXACTLY_ONE, "The name of the system property to retrieve the value of.")
},
new FunctionReturnSequenceType(Type.STRING, Cardinality.ZERO_OR_ONE, "the value of the named system property")
public final static FunctionSignature signature = functionSignature(
"system-property",
"Returns the value of a system property. Similar to the corresponding XSLT function. " +
"Predefined properties are: vendor, vendor-url, product-name, product-version, product-build, and all Java " +
"System Properties.",
returnsOpt(Type.STRING, "the value of the named system property"),
param("property-name", Type.STRING, "The name of the system property to retrieve the value of.")
);

public SystemProperty(XQueryContext context, FunctionSignature signature) {
public SystemProperty(final XQueryContext context, final FunctionSignature signature) {
super(context, signature);
}

/* (non-Javadoc)
* @see org.exist.xquery.BasicFunction#eval(org.exist.xquery.value.Sequence[], org.exist.xquery.value.Sequence)
*/
@Override
public Sequence eval(Sequence[] args, Sequence contextSequence) throws XPathException {

public Sequence eval(final Sequence[] args, final Sequence contextSequence) throws XPathException {
final String key = args[0].getStringValue();
String value = SystemProperties.getInstance().getSystemProperty(key, null);
if(value == null) {
value = System.getProperty(key);
if (value == null) {
value = System.getProperty(key);
}
return value == null ? Sequence.EMPTY_SEQUENCE : new StringValue(this, value);
}
Expand Down