Use PipeParser for inbound HL7 to remove XML/XXE attack surface (2.7.x backport of #6223)#6321
Open
dkayiwa wants to merge 1 commit into
Open
Use PipeParser for inbound HL7 to remove XML/XXE attack surface (2.7.x backport of #6223)#6321dkayiwa wants to merge 1 commit into
dkayiwa wants to merge 1 commit into
Conversation
Backport of openmrs#6223 to 2.7.x. The hL7Parser bean was a HAPI GenericParser, which auto-detects message encoding and routes XML-encoded payloads to HAPI's XML parser. On hapi-base 2.1 that parser builds an unhardened LSParser (no disallow-doctype-decl, external general/parameter entities enabled), exposing XML external entity (XXE) processing: external file reads, SSRF and entity-expansion DoS. Inbound HL7 parsing runs before authorization, so the surface is reachable pre-auth. OpenMRS only ever produces and consumes pipe-delimited (ER7) HL7v2, so the XML branch is unused. Switch the bean to PipeParser, which rejects XML payloads outright with an unsupported-encoding error. The HL7ServiceImpl parser field and setter are widened to the common Parser supertype so the existing XML setter injection still resolves. Adds a regression test. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
ibacher
approved these changes
Jul 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #6223 to the 2.7.x maintenance line.
The
hL7Parserbean on 2.7.x is a HAPIGenericParser, which routes XML-encoded payloads to HAPI's XML parser. On hapi-base 2.1 that parser builds anLSParserwith no XXE hardening, so an XML message with a DOCTYPE/external entity yields XXE (local file reads, SSRF, entity-expansion DoS). Inbound HL7 parsing runs before the authorization check, so the surface is reachable without authentication.master removed this in #6223; 2.7.x/2.8.x/2.9.x still ship the
GenericParserbean.Switches the bean to
PipeParser(ER7 only), which rejects XML outright before any XML processing; widensHL7ServiceImpl.parserto theParsersupertype so the XML setter injection still resolves; adds a regression test.Addresses GHSA-27xq-2wmf-6hpg and GHSA-2h4h-2mf9-836w on 2.7.x.