Use PipeParser for inbound HL7 to remove XML/XXE attack surface (2.9.x backport of #6223)#6319
Merged
Merged
Conversation
Backport of openmrs#6223 to 2.9.x. The hL7Parser bean was a HAPI GenericParser, which auto-detects message encoding and routes XML-encoded payloads to HAPI's XML parser. On hapi-base 2.1 that parser builds an unhardened LSParser (no disallow-doctype-decl, external general/parameter entities enabled), exposing XML external entity (XXE) processing: external file reads, SSRF and entity-expansion DoS. Inbound HL7 parsing runs before authorization, so the surface is reachable pre-auth. OpenMRS only ever produces and consumes pipe-delimited (ER7) HL7v2, so the XML branch is unused. Switch the bean to PipeParser, which rejects XML payloads outright with an unsupported-encoding error. The HL7ServiceImpl parser field and setter are widened to the common Parser supertype so the existing XML setter injection still resolves. Adds a regression test. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #6223 to the 2.9.x maintenance line.
Why
The
hL7Parserbean on 2.9.x is a HAPIGenericParser, which auto-detects encoding and routes XML-encoded payloads to HAPI's XML parser. On hapi-base 2.1 that parser builds anLSParserwith no XXE hardening (nodisallow-doctype-decl, external entities enabled), so an XML message with a DOCTYPE/external entity yields XXE: local file reads, SSRF, and entity-expansion DoS. Inbound HL7 parsing runs before the authorization check, so the surface is reachable without authentication.master already removed this in #6223; 2.7.x/2.8.x/2.9.x still ship the
GenericParserbean.Change
Switch the bean to
PipeParser(ER7 only), which rejects XML outright with an unsupported-encoding error before any XML processing.HL7ServiceImpl'sparserfield and setter are widened to the commonParsersupertype so the XML setter injection still resolves. Adds a regression test asserting an XML/DOCTYPE/external-entity payload is refused.Addresses GHSA-27xq-2wmf-6hpg and GHSA-2h4h-2mf9-836w on 2.9.x.