Use PipeParser for inbound HL7 to remove XML/XXE attack surface (#6319)

Backport of #6223 to 2.9.x.

The hL7Parser bean was a HAPI GenericParser, which auto-detects message
encoding and routes XML-encoded payloads to HAPI's XML parser. On
hapi-base 2.1 that parser builds an unhardened LSParser (no
disallow-doctype-decl, external general/parameter entities enabled),
exposing XML external entity (XXE) processing: external file reads, SSRF
and entity-expansion DoS. Inbound HL7 parsing runs before authorization,
so the surface is reachable pre-auth.

OpenMRS only ever produces and consumes pipe-delimited (ER7) HL7v2, so the
XML branch is unused. Switch the bean to PipeParser, which rejects XML
payloads outright with an unsupported-encoding error. The HL7ServiceImpl
parser field and setter are widened to the common Parser supertype so the
existing XML setter injection still resolves. Adds a regression test.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: dkayiwa

api/src/main/java/org/openmrs/hl7/impl/HL7ServiceImpl.java

@@ -41,7 +41,7 @@
 import ca.uhn.hl7v2.model.v25.segment.NK1;
 import ca.uhn.hl7v2.model.v25.segment.PID;
 import ca.uhn.hl7v2.parser.EncodingNotSupportedException;
-import ca.uhn.hl7v2.parser.GenericParser;
+import ca.uhn.hl7v2.parser.Parser;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.exception.ExceptionUtils;
 import org.openmrs.Location;
@@ -88,7 +88,7 @@ public class HL7ServiceImpl extends BaseOpenmrsService implements HL7Service {
 
 	protected HL7DAO dao;
 
-	private GenericParser parser;
+	private Parser parser;
 
 	private MessageTypeRouter router;
 
@@ -105,7 +105,7 @@ public void setHL7DAO(HL7DAO dao) {
 	 *
 	 * @param parser the parser to use
 	 */
-	public void setParser(GenericParser parser) {
+	public void setParser(Parser parser) {
 		this.parser = parser;
 	}
 

api/src/main/resources/applicationContext-service.xml

@@ -297,7 +297,10 @@
 	<bean id="hL7ServiceTarget" class="org.openmrs.hl7.impl.HL7ServiceImpl">
 		<property name="HL7DAO" ref="hL7DAO"/>
 		<property name="parser">
-			<bean class="ca.uhn.hl7v2.parser.GenericParser"/>
+			<!-- PipeParser (ER7 only), not GenericParser: rejects XML-encoded payloads outright
+			     rather than routing them to HAPI's XML parser, which can expose XXE (external file
+			     reads, SSRF, entity-expansion DoS) when its JAXP factory is not hardened. -->
+			<bean class="ca.uhn.hl7v2.parser.PipeParser"/>
 		</property>
 		<property name="router">
 			<bean class="ca.uhn.hl7v2.app.MessageTypeRouter"/>

api/src/test/java/org/openmrs/hl7/HL7ServiceTest.java

@@ -186,6 +186,28 @@ public void parseHL7String_shouldParseTheGivenStringIntoMessage() throws HL7Exce
 		                + "OBX|2|DT|5096^RETURN VISIT DATE^99DCT||20080229|||||||||20080212");
 		assertNotNull(message);
 	}
+
+	/**
+	 * The {@code hL7Parser} bean is a {@link ca.uhn.hl7v2.parser.PipeParser} (not a
+	 * {@code GenericParser}), so an XML-encoded payload is rejected outright with an unsupported
+	 * encoding error instead of being routed to HAPI's XML parser, which can expose XML external entity
+	 * (XXE) processing when its underlying JAXP factory is not hardened. This guards against a
+	 * regression that reintroduces XML parsing of inbound HL7. The DOCTYPE/external entity below is
+	 * never resolved because the message is refused before any XML processing occurs.
+	 *
+	 * @see HL7Service#parseHL7String(String)
+	 */
+	@Test
+	public void parseHL7String_shouldRejectXmlEncodedMessages() {
+		HL7Service hl7service = Context.getHL7Service();
+		String xmlHl7 = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"
+		        + "<!DOCTYPE ORU_R01 [ <!ENTITY xxe SYSTEM \"file:///etc/passwd\"> ]>\n"
+		        + "<ORU_R01 xmlns=\"urn:hl7-org:v2xml\">\n" + "  <MSH><MSH.1>|</MSH.1><MSH.2>^~\\&amp;</MSH.2></MSH>\n"
+		        + "  <PID><PID.5><XPN.1>&xxe;</XPN.1></PID.5></PID>\n" + "</ORU_R01>";
+		HL7Exception thrown = assertThrows(HL7Exception.class, () -> hl7service.parseHL7String(xmlHl7));
+		assertEquals("HL7 encoding not supported", thrown.getMessage());
+	}
+
 
 	/**
 	 * @see HL7Service#processHL7Message(Message)