[SECURITY-165] blacklist the document xpath function for use in Api

core/src/main/java/hudson/model/Api.java

@@ -23,6 +23,7 @@
  */
 package hudson.model;
 
+import jenkins.dom4j.FilteredFunctionContext;
 import jenkins.model.Jenkins;
 import jenkins.security.SecureRequester;
 
@@ -31,6 +32,7 @@ import org.dom4j.Document;
 import org.dom4j.DocumentException;
 import org.dom4j.DocumentFactory;
 import org.dom4j.Element;
+import org.dom4j.XPath;
 import org.dom4j.io.SAXReader;
 import org.dom4j.io.XMLWriter;
 import org.kohsuke.stapler.QueryParameter;
@@ -106,14 +108,16 @@ public class Api extends AbstractModelObject {
         p.writeTo(bean,pruner,Flavor.XML.createDataWriter(bean,sw));
 
         // apply XPath
+        FilteredFunctionContext functionContext = new FilteredFunctionContext();
         Object result;
         try {
             Document dom = new SAXReader().read(new StringReader(sw.toString()));
-
             // apply exclusions
             if (excludes!=null) {
                 for (String exclude : excludes) {
-                    List<org.dom4j.Node> list = (List<org.dom4j.Node>)dom.selectNodes(exclude);
+                    XPath xExclude = dom.createXPath(exclude);
+                    xExclude.setFunctionContext(functionContext);
+                    List<org.dom4j.Node> list = (List<org.dom4j.Node>)xExclude.selectNodes(dom);
                     for (org.dom4j.Node n : list) {
                         Element parent = n.getParent();
                         if(parent!=null)
@@ -125,7 +129,9 @@ public class Api extends AbstractModelObject {
             if(xpath==null) {
             	result = dom;
             } else {
-                List list = dom.selectNodes(xpath);
+                XPath comp = dom.createXPath(xpath);
+                comp.setFunctionContext(functionContext);
+                List list = comp.selectNodes(dom);
                 if (wrapper!=null) {
                     Element root = DocumentFactory.getInstance().createElement(wrapper);
                     for (Object o : list) {

core/src/main/java/jenkins/dom4j/FilteredFunctionContext.java

@@ -0,0 +1,49 @@
+package jenkins.dom4j;
+
+import org.jaxen.Function;
+import org.jaxen.FunctionContext;
+import org.jaxen.UnresolvableException;
+import org.jaxen.XPathFunctionContext;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * {@link org.jaxen.FunctionContext} that removes some {@link org.dom4j.XPath}
+ * function names that are deemed bad as user input.
+ *
+ * @author Robert Sandell <rsandell@cloudbees.com>.
+ * @see org.jaxen.FunctionContext
+ * @see org.dom4j.XPath
+ * @see hudson.model.Api
+ */
+public class FilteredFunctionContext implements FunctionContext {
+
+    /**
+     * Default set of "bad" function names.
+     */
+    private static final Set<String> DEFAULT_ILLEGAL_FUNCTIONS = Collections.unmodifiableSet(new HashSet<String>(
+            Arrays.asList("document")
+    ));
+    private final FunctionContext base;
+    private final Set<String> illegalFunctions;
+
+    public FilteredFunctionContext(Set<String> illegalFunctions) {
+        this.illegalFunctions = illegalFunctions;
+        base = XPathFunctionContext.getInstance();
+    }
+
+    public FilteredFunctionContext() {
+        this(DEFAULT_ILLEGAL_FUNCTIONS);
+    }
+
+    @Override
+    public Function getFunction(String namespaceURI, String prefix, String localName) throws UnresolvableException {
+        if (localName != null && illegalFunctions.contains(localName.toLowerCase())) {
+            throw new UnresolvableException("Illegal function: " + localName);
+        }
+        return base.getFunction(namespaceURI, prefix, localName);
+    }
+}