enhance EFormUtils to validate ORSR URLs and add corresponding tests

src/main/java/digital/slovensko/autogram/core/eforms/EFormUtils.java

@@ -63,6 +63,12 @@
 public abstract class EFormUtils {
     private static final Charset ENCODING = StandardCharsets.UTF_8;
     public static final String XDC_XMLNS = "http://data.gov.sk/def/container/xmldatacontainer+xml/1.1";
+    public static final List<String> ALLOWED_ORSR_URL_PREFIXES = List.of(
+            "http://eformulare.justice.sk/",
+            "https://eformulare.justice.sk/",
+            "http://www.justice.gov.sk/",
+            "https://www.justice.gov.sk/"
+    );
 
     public static String extractTransformationOutputMimeTypeString(String transformation)
             throws TransformationParsingErrorException {
@@ -398,7 +404,10 @@ public static String fillXsdIdentifier(String formIdentifier) {
     }
 
     public static boolean isOrsrUri(String uri) {
-        return uri != null && (uri.contains("://eformulare.justice.sk") || uri.contains("justice.gov.sk/"));
+        if (uri == null)
+            return false;
+        var namespace = uri.split("\\s+")[0];
+        return ALLOWED_ORSR_URL_PREFIXES.stream().anyMatch(namespace::startsWith);
     }
 
     public static String getFsFormIdFromFilename(String filename) {

src/main/java/digital/slovensko/autogram/core/eforms/OrsrEFormResources.java

@@ -2,6 +2,7 @@
 
 import digital.slovensko.autogram.core.errors.XMLValidationException;
 
+import static digital.slovensko.autogram.core.eforms.EFormUtils.ALLOWED_ORSR_URL_PREFIXES;
 import static digital.slovensko.autogram.core.eforms.EFormUtils.getResource;
 import static digital.slovensko.autogram.core.errors.XMLValidationException.Error.XSD_NOT_FOUND;
 import static digital.slovensko.autogram.core.errors.XMLValidationException.Error.XSLT_NOT_FOUND;
@@ -16,8 +17,15 @@ public OrsrEFormResources(String url, String schema, String transformation) {
         this.transformation = transformation;
     }
 
+    private static void validateResourceUrl(String resourceUrl) throws XMLValidationException {
+        if (resourceUrl == null || ALLOWED_ORSR_URL_PREFIXES.stream().noneMatch(resourceUrl::startsWith))
+            throw new XMLValidationException(XSD_NOT_FOUND);
+    }
+
     @Override
     public boolean findResources() throws XMLValidationException {
+        validateResourceUrl(url);
+
         if (schema == null) {
             var schema_raw = getResource(url);
             if (schema_raw == null)
@@ -28,14 +36,14 @@ public boolean findResources() throws XMLValidationException {
 
         if (transformation == null) {
             var transformationUrl = url.replace(".xsd", ".xslt");
+            validateResourceUrl(transformationUrl);
             var transformation_raw = getResource(transformationUrl);
             if (transformation_raw == null)
                 throw new XMLValidationException(XSLT_NOT_FOUND);
 
             transformation = new String(transformation_raw, ENCODING);
             if (!transformation.isEmpty() && transformation.charAt(0) == '\uFEFF')
                 transformation = transformation.substring(1);
-
         }
 
         return true;

src/main/java/digital/slovensko/autogram/util/XMLUtils.java

@@ -15,7 +15,9 @@ public abstract class XMLUtils {
     public static DocumentBuilder getSecureDocumentBuilder() throws ParserConfigurationException {
         var builderFactory = DocumentBuilderFactory.newInstance();
         builderFactory.setNamespaceAware(true);
+        builderFactory.setXIncludeAware(false);
         builderFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+        builderFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
         builderFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
         builderFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
         builderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
@@ -37,6 +39,7 @@ public static SchemaFactory getSecureSchemaFactory() throws SAXNotRecognizedExce
         schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
         schemaFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
         schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
+        schemaFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
 
         return schemaFactory;
     }

src/test/java/digital/slovensko/autogram/core/eforms/EFormUtilsTests.java

@@ -1,6 +1,7 @@
 package digital.slovensko.autogram.core.eforms;
 
 import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.CsvSource;
 
@@ -32,4 +33,22 @@ void testGetFsFormIdFromFilename(String filename, String expected) {
     void testTranslateFsFormId(String fsFormId, String expected) {
         Assertions.assertEquals(expected, EFormUtils.translateFsFormId(fsFormId));
     }
+
+    @ParameterizedTest
+    @CsvSource({
+            "http://www.justice.gov.sk/Forms,true",
+            "http://www.justice.gov.sk/Forms http://eformulare.justice.sk/path/form.xsd,true",
+            "http://eformulare.justice.sk/form,true",
+            "http://evil.com/form http://www.justice.gov.sk/form.xsd,false",
+            "http://evil.com/?x=justice.gov.sk/Forms,false",
+            "http://httpbin.org/forms,false",
+    })
+    void testIsOrsrUri(String uri, boolean expected) {
+        Assertions.assertEquals(expected, EFormUtils.isOrsrUri(uri));
+    }
+
+    @Test
+    void testIsOrsrUriReturnsFalseForNull() {
+        Assertions.assertFalse(EFormUtils.isOrsrUri(null));
+    }
 }

src/test/java/digital/slovensko/autogram/core/eforms/OrsrEFormResourcesTests.java

@@ -0,0 +1,21 @@
+package digital.slovensko.autogram.core.eforms;
+
+import digital.slovensko.autogram.core.errors.XMLValidationException;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
+public class OrsrEFormResourcesTests {
+
+    @ParameterizedTest
+    @ValueSource(strings = {
+            "http://www.justice.gov.sk/Forms http://httpbin.org/get?ssrf=proof",
+            "http://www.justice.gov.sk/Forms file:///etc/passwd",
+            "http://www.justice.gov.sk/Forms http://evil.com/evil.xsd",
+    })
+    void testFindResourcesRejectsNonOrsrUrl(String schemaLocation) {
+        var resources = new OrsrEFormResources(schemaLocation, null, null);
+        Assertions.assertThrows(XMLValidationException.class, resources::findResources);
+    }
+}
+