Skip to content

Fix XXE in XML batch parsing #452

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mgaffigan merged 4 commits into from
Sep 29, 2026
Merged

Fix XXE in XML batch parsing #452

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
456848e
Add server endpoint for submitting a batch message
mgaffigan Sep 19, 2026
df1e936
Support multi-message fixtures in the smoke test harness
mgaffigan Sep 19, 2026
26fbdc5
Add XXE test during xml parse batch (CVE-2026-82578)
mgaffigan Sep 19, 2026
77e86a5
Fix XXE in XML batch parsing
mgaffigan Sep 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 31 additions & 3 deletions ci/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,16 +35,26 @@ ci/tests/
```

`channel.xml` is an exported OIE channel. Every message fixture requires `source`,
the payload sent to the channel. The other files are optional assertions:
the payload sent to the channel. These files describe the submission:

| File | Assertion |
| File | Meaning |
| --- | --- |
| `source` | The payload sent to the channel. Required. |
| `source_sourcemap.yml` | Source map supplied with `source` |
| `source_rejected` | The server must refuse the submission. |

The rest are optional assertions against the message the channel produced:

| File | Assertion |
| --- | --- |
| `source_metadata.yml` | Selected source message metadata |
| `source_raw` | Raw source payload |
| `source_encoded` | Encoded source payload |
| `source_status` | Source status |
| `source_response` | Source response payload |
| `source_transformed` | Transformed source payload |
| `source_encoded` | Encoded source payload |
| `destNN_raw` | Raw payload for destination `NN` |
| `destNN_encoded` | Encoded payload for destination `NN` |
| `destNN` | Sent payload for destination `NN` |
| `destNN_transformed` | Transformed payload for destination `NN` |
| `destNN_response` | Response payload from destination `NN` |
Expand All @@ -64,6 +74,24 @@ alpine-temurin21-postgres
ubuntu-temurin21-postgres
```

### Parse Batch

If you are using "Parse Batch" mode, put each expected message's assertion
files in a numbered subdirectory instead. There must be one directory per
expected message.

```text
messages/
03-two-messages/
source
01/
source_raw
source_status
02/
source_raw
source_status
```

## Add a Configuration

Add a Compose file at `ci/configurations/<name>.compose.yml`. Configuration names
Expand Down
226 changes: 226 additions & 0 deletions ci/tests/120-delimited-batch/channels/01-csv/channel.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,226 @@
<channel version="4.6.0">
<id>732e3b46-e151-47e8-8699-d10d088e99db</id>
<nextMetaDataId>2</nextMetaDataId>
<name>CSV batch</name>
<description></description>
<revision>1</revision>
<sourceConnector version="4.6.0">
<metaDataId>0</metaDataId>
<name>sourceConnector</name>
<properties class="com.mirth.connect.connectors.vm.VmReceiverProperties" version="4.6.0">
<pluginProperties/>
<sourceConnectorProperties version="4.6.0">
<responseVariable>None</responseVariable>
<respondAfterProcessing>true</respondAfterProcessing>
<processBatch>true</processBatch>
<firstResponse>false</firstResponse>
<processingThreads>1</processingThreads>
<resourceIds class="linked-hash-map">
<entry>
<string>Default Resource</string>
<string>[Default Resource]</string>
</entry>
</resourceIds>
<queueBufferSize>1000</queueBufferSize>
</sourceConnectorProperties>
</properties>
<transformer version="4.6.0">
<elements/>
<inboundDataType>DELIMITED</inboundDataType>
<outboundDataType>XML</outboundDataType>
<inboundProperties class="com.mirth.connect.plugins.datatypes.delimited.DelimitedDataTypeProperties" version="4.6.0">
<serializationProperties class="com.mirth.connect.plugins.datatypes.delimited.DelimitedSerializationProperties" version="4.6.0">
<columnDelimiter>,</columnDelimiter>
<recordDelimiter>\n</recordDelimiter>
<quoteToken>&quot;</quoteToken>
<escapeWithDoubleQuote>true</escapeWithDoubleQuote>
<quoteEscapeToken>\</quoteEscapeToken>
<columnNames>
<string>Name</string>
<string>Description</string>
</columnNames>
<numberedRows>false</numberedRows>
<ignoreCR>true</ignoreCR>
</serializationProperties>
<deserializationProperties class="com.mirth.connect.plugins.datatypes.delimited.DelimitedDeserializationProperties" version="4.6.0">
<columnDelimiter>,</columnDelimiter>
<recordDelimiter>\n</recordDelimiter>
<quoteToken>&quot;</quoteToken>
<escapeWithDoubleQuote>true</escapeWithDoubleQuote>
<quoteEscapeToken>\</quoteEscapeToken>
</deserializationProperties>
<batchProperties class="com.mirth.connect.plugins.datatypes.delimited.DelimitedBatchProperties" version="4.6.0">
<splitType>Record</splitType>
<batchSkipRecords>0</batchSkipRecords>
<batchMessageDelimiter></batchMessageDelimiter>
<batchMessageDelimiterIncluded>false</batchMessageDelimiterIncluded>
<batchGroupingColumn></batchGroupingColumn>
<batchScript></batchScript>
</batchProperties>
</inboundProperties>
<outboundProperties class="com.mirth.connect.plugins.datatypes.xml.XMLDataTypeProperties" version="4.6.0">
<serializationProperties class="com.mirth.connect.plugins.datatypes.xml.XMLSerializationProperties" version="4.6.0">
<stripNamespaces>false</stripNamespaces>
</serializationProperties>
<batchProperties class="com.mirth.connect.plugins.datatypes.xml.XMLBatchProperties" version="4.6.0">
<splitType>Element_Name</splitType>
<elementName></elementName>
<level>1</level>
<query></query>
<batchScript></batchScript>
</batchProperties>
</outboundProperties>
</transformer>
<filter version="4.6.0">
<elements/>
</filter>
<transportName>Channel Reader</transportName>
<mode>SOURCE</mode>
<enabled>true</enabled>
<waitForPrevious>true</waitForPrevious>
</sourceConnector>
<destinationConnectors>
<connector version="4.6.0">
<metaDataId>1</metaDataId>
<name>Destination 1</name>
<properties class="com.mirth.connect.connectors.vm.VmDispatcherProperties" version="4.6.0">
<pluginProperties/>
<destinationConnectorProperties version="4.6.0">
<queueEnabled>false</queueEnabled>
<sendFirst>false</sendFirst>
<retryIntervalMillis>10000</retryIntervalMillis>
<regenerateTemplate>false</regenerateTemplate>
<retryCount>0</retryCount>
<rotate>false</rotate>
<includeFilterTransformer>false</includeFilterTransformer>
<threadCount>1</threadCount>
<threadAssignmentVariable></threadAssignmentVariable>
<validateResponse>false</validateResponse>
<resourceIds class="linked-hash-map">
<entry>
<string>Default Resource</string>
<string>[Default Resource]</string>
</entry>
</resourceIds>
<queueBufferSize>1000</queueBufferSize>
<reattachAttachments>true</reattachAttachments>
</destinationConnectorProperties>
<channelId>none</channelId>
<channelTemplate>${message.encodedData}</channelTemplate>
<mapVariables/>
</properties>
<transformer version="4.6.0">
<elements/>
<inboundDataType>XML</inboundDataType>
<outboundDataType>XML</outboundDataType>
<inboundProperties class="com.mirth.connect.plugins.datatypes.xml.XMLDataTypeProperties" version="4.6.0">
<serializationProperties class="com.mirth.connect.plugins.datatypes.xml.XMLSerializationProperties" version="4.6.0">
<stripNamespaces>false</stripNamespaces>
</serializationProperties>
<batchProperties class="com.mirth.connect.plugins.datatypes.xml.XMLBatchProperties" version="4.6.0">
<splitType>Element_Name</splitType>
<elementName></elementName>
<level>1</level>
<query></query>
<batchScript></batchScript>
</batchProperties>
</inboundProperties>
<outboundProperties class="com.mirth.connect.plugins.datatypes.xml.XMLDataTypeProperties" version="4.6.0">
<serializationProperties class="com.mirth.connect.plugins.datatypes.xml.XMLSerializationProperties" version="4.6.0">
<stripNamespaces>false</stripNamespaces>
</serializationProperties>
<batchProperties class="com.mirth.connect.plugins.datatypes.xml.XMLBatchProperties" version="4.6.0">
<splitType>Element_Name</splitType>
<elementName></elementName>
<level>1</level>
<query></query>
<batchScript></batchScript>
</batchProperties>
</outboundProperties>
</transformer>
<responseTransformer version="4.6.0">
<elements/>
<inboundDataType>RAW</inboundDataType>
<outboundDataType>RAW</outboundDataType>
<inboundProperties class="com.mirth.connect.plugins.datatypes.raw.RawDataTypeProperties" version="4.6.0">
<batchProperties class="com.mirth.connect.plugins.datatypes.raw.RawBatchProperties" version="4.6.0">
<splitType>JavaScript</splitType>
<batchScript></batchScript>
</batchProperties>
</inboundProperties>
<outboundProperties class="com.mirth.connect.plugins.datatypes.raw.RawDataTypeProperties" version="4.6.0">
<batchProperties class="com.mirth.connect.plugins.datatypes.raw.RawBatchProperties" version="4.6.0">
<splitType>JavaScript</splitType>
<batchScript></batchScript>
</batchProperties>
</outboundProperties>
</responseTransformer>
<filter version="4.6.0">
<elements/>
</filter>
<transportName>Channel Writer</transportName>
<mode>DESTINATION</mode>
<enabled>true</enabled>
<waitForPrevious>true</waitForPrevious>
</connector>
</destinationConnectors>
<preprocessingScript>// Modify the message variable below to pre process data
return message;</preprocessingScript>
<postprocessingScript>// This script executes once after a message has been processed
// Responses returned from here will be stored as &quot;Postprocessor&quot; in the response map
return;</postprocessingScript>
<deployScript>// This script executes once when the channel is deployed
// You only have access to the globalMap and globalChannelMap here to persist data
return;</deployScript>
<undeployScript>// This script executes once when the channel is undeployed
// You only have access to the globalMap and globalChannelMap here to persist data
return;</undeployScript>
<properties version="4.6.0">
<clearGlobalChannelMap>true</clearGlobalChannelMap>
<messageStorageMode>DEVELOPMENT</messageStorageMode>
<encryptData>false</encryptData>
<encryptAttachments>false</encryptAttachments>
<encryptCustomMetaData>false</encryptCustomMetaData>
<removeContentOnCompletion>false</removeContentOnCompletion>
<removeOnlyFilteredOnCompletion>false</removeOnlyFilteredOnCompletion>
<removeAttachmentsOnCompletion>false</removeAttachmentsOnCompletion>
<initialState>STARTED</initialState>
<storeAttachments>true</storeAttachments>
<metaDataColumns>
<metaDataColumn>
<name>SOURCE</name>
<type>STRING</type>
<mappingName>mirth_source</mappingName>
</metaDataColumn>
<metaDataColumn>
<name>TYPE</name>
<type>STRING</type>
<mappingName>mirth_type</mappingName>
</metaDataColumn>
</metaDataColumns>
<attachmentProperties version="4.6.0">
<type>None</type>
<properties/>
</attachmentProperties>
<resourceIds class="linked-hash-map">
<entry>
<string>Default Resource</string>
<string>[Default Resource]</string>
</entry>
</resourceIds>
</properties>
<exportData>
<metadata>
<enabled>true</enabled>
<lastModified>
<time>1789834147577</time>
<timezone>America/Chicago</timezone>
</lastModified>
<pruningSettings>
<archiveEnabled>true</archiveEnabled>
<pruneErroredMessages>false</pruneErroredMessages>
</pruningSettings>
<userId>1</userId>
</metadata>
</exportData>
</channel>
1 change: 1 addition & 0 deletions ci/tests/120-delimited-batch/channels/01-csv/messages/01-batch/01/source_raw
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
OIE,Awesome
1 change: 1 addition & 0 deletions ci/tests/120-delimited-batch/channels/01-csv/messages/01-batch/01/source_transformed
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
<delimited><row><Name>OIE</Name><Description>Awesome</Description></row></delimited>
1 change: 1 addition & 0 deletions ci/tests/120-delimited-batch/channels/01-csv/messages/01-batch/02/source_raw
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Other,Not as awesome
1 change: 1 addition & 0 deletions ci/tests/120-delimited-batch/channels/01-csv/messages/01-batch/02/source_transformed
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
<delimited><row><Name>Other</Name><Description>Not as awesome</Description></row></delimited>
2 changes: 2 additions & 0 deletions ci/tests/120-delimited-batch/channels/01-csv/messages/01-batch/source
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
OIE,Awesome
Other,Not as awesome
Loading
Loading