Fix SQLi + XXE CVEs (CVE-2026-82583, -78224, -82578) with regression tests

Three vulnerabilities reported against NextGen/Mirth Connect are present in
this 4.6.0 tree (below every upstream fix version). Each is fixed using the
project's own established idioms, and each is covered by an integration test in
the ci/smoketest harness that is RED on the vulnerable code and GREEN once the
fix is applied.

CVE-2026-82583 (SQL injection): DatabaseConnectorServlet.getTables executed the
caller-supplied selectLimit query parameter verbatim via Statement.executeQuery.
The Database connector metadata dialog only ever sends a selectLimit taken from
the configured driver list, so selectLimit is now validated against that list
(getDatabaseDrivers plus the built-in DriverInfo defaults, which are always
included so a cleared list cannot disable the check) before any SQL runs. A
non-allowlisted value is rejected with a generic exception that does not reflect
the input. A blank value still routes to the safe DatabaseMetaData.getColumns
path. Not fixed here (noted as follow-ups): the endpoint's missing
@MirthOperation permission and unconstrained driver/url, a gap shared by every
connector test servlet.

CVE-2026-78224 (XSLT step XXE): XsltStep builds a TransformerFactory inside
generated JavaScript, so it was never reached by the Java-side XML hardening.
The generated script now enables FEATURE_SECURE_PROCESSING and sets
ACCESS_EXTERNAL_DTD/ACCESS_EXTERNAL_STYLESHEET to "" (setAttribute guarded for
implementations that reject it), on both the normal and iterator paths, blocking
external entity resolution in the stylesheet and the source XML.

CVE-2026-82578 (XML batch XXE): XMLBatchAdaptor evaluated XPath directly over an
InputSource, letting XPath build its own DOCTYPE-resolving parser. It now parses
with DocumentSerializer.getSecureDocumentBuilderFactory() (disallow-doctype-decl,
external entities/DTD off, no entity expansion) and evaluates against the parsed
Document. The output path in this file was already hardened; only the reader side
was missed.

Tests:
- XsltStepSecurityTest (unit): asserts the hardening is emitted into the script.
- DatabaseConnectorSqlInjectionTest, XsltStepXxeTest, XmlBatchXxeTest (smoketest):
  drive the live server; SQLi runs on DB-backed configurations (DB coordinates
  passed as oie.db.* via run-configuration.sh + harness.compose.yml) and skips
  embedded-Derby, the XXE tests build channels from a base fixture via new
  OieServer/SecurityChannels helpers.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: jonbartels

ci/harness.compose.yml

@@ -19,5 +19,9 @@ services:
       OIE_BASE_URL: https://oie:8443
       OIE_CONFIGURATION: ${OIE_CONFIGURATION}
       OIE_PASSWORD: ${OIE_ADMIN_PASSWORD}
+      # Extra -D flags forwarded to the JUnit JVM. run-configuration.sh sets these to the DB
+      # coordinates for DB-backed configurations so the SQL-injection test can reach the database;
+      # empty for embedded-Derby configurations, where that test skips.
+      OIE_HARNESS_OPTS: ${OIE_HARNESS_OPTS:-}
     volumes:
       - ${WORKSPACE}/ci/test-results:/results

ci/run-configuration.sh

@@ -14,15 +14,36 @@ if [[ ! -f "$1" ]]; then
     exit 2
 fi
 export OIE_IMAGE="$2"
-export OIE_CONFIGURATION="$(basename "$1" .compose.yml)"
+OIE_CONFIGURATION="$(basename "$1" .compose.yml)"
+export OIE_CONFIGURATION
 # The engine generates a random admin password on first boot, so the stack and the
 # harness have to agree on one up front. See ci/harness.compose.yml.
 export OIE_ADMIN_PASSWORD="${OIE_ADMIN_PASSWORD:-ci-smoke-admin}"
 export WORKSPACE="$PWD"
-export HOST_UID="$(id -u)"
-export HOST_GID="$(id -g)"
+HOST_UID="$(id -u)"
+export HOST_UID
+HOST_GID="$(id -g)"
+export HOST_GID
 mkdir -p "$WORKSPACE/ci/test-results"
 
+# Database coordinates for the DB-backed configurations, forwarded to the harness (see
+# ci/harness.compose.yml) so the SQL-injection smoke test can drive the JDBC metadata endpoint
+# against the same database the stack uses. The endpoint runs inside the oie container, so the URL
+# host is the compose "db" service. Embedded-Derby configurations expose no separate database
+# service and are left unset, so that test skips. Values are space-separated -D flags and must not
+# themselves contain spaces (run-harness.sh word-splits them onto the java command line).
+case "$OIE_CONFIGURATION" in
+    *-postgres)
+        export OIE_HARNESS_OPTS="-Doie.db.driver=org.postgresql.Driver -Doie.db.url=jdbc:postgresql://db:5432/mirthdb -Doie.db.user=mirthdb -Doie.db.password=mirthdb"
+        ;;
+    *-mysql)
+        export OIE_HARNESS_OPTS="-Doie.db.driver=com.mysql.cj.jdbc.Driver -Doie.db.url=jdbc:mysql://db:3306/mirthdb -Doie.db.user=mirthdb -Doie.db.password=mirthdb"
+        ;;
+    *)
+        export OIE_HARNESS_OPTS=""
+        ;;
+esac
+
 compose=(docker compose -f "$1" -f ci/harness.compose.yml -p "oie-ci-${OIE_CONFIGURATION//[^a-z0-9-]/-}-$$")
 
 cleanup() {

server/src/main/java/com/mirth/connect/connectors/jdbc/DatabaseConnectorServlet.java

@@ -33,7 +33,9 @@
 import org.apache.logging.log4j.Logger;
 
 import com.mirth.connect.client.core.api.MirthApiException;
+import com.mirth.connect.model.DriverInfo;
 import com.mirth.connect.server.api.MirthServlet;
+import com.mirth.connect.server.controllers.ConfigurationController;
 import com.mirth.connect.server.controllers.ContextFactoryController;
 import com.mirth.connect.server.controllers.ControllerFactory;
 import com.mirth.connect.server.util.TemplateValueReplacer;
@@ -45,13 +47,18 @@ public class DatabaseConnectorServlet extends MirthServlet implements DatabaseCo
     private static final Logger logger = LogManager.getLogger(DatabaseConnectorServlet.class);
     private static final TemplateValueReplacer replacer = new TemplateValueReplacer();
     private static final ContextFactoryController contextFactoryController = ControllerFactory.getFactory().createContextFactoryController();
+    private static final ConfigurationController configurationController = ControllerFactory.getFactory().createConfigurationController();
 
     public DatabaseConnectorServlet(@Context HttpServletRequest request, @Context SecurityContext sc) {
         super(request, sc, PLUGIN_POINT);
     }
 
     @Override
     public SortedSet<Table> getTables(String channelId, String channelName, String driver, String url, String username, String password, Set<String> tableNamePatterns, String selectLimit, Set<String> resourceIds) {
+        // Reject any selectLimit that is not one the server itself configured, before it can be
+        // executed as SQL (CVE-2026-82583). Done outside the try below so it is not re-wrapped.
+        validateSelectLimit(selectLimit);
+
         CustomDriver customDriver = null;
         Connection connection = null;
         try {
@@ -229,6 +236,49 @@ public SortedSet<Table> getTables(String channelId, String channelName, String d
         }
     }
 
+    /**
+     * Validates the caller-supplied {@code selectLimit} against the server's configured driver list
+     * before it is ever executed as SQL. The Database connector metadata dialog only ever sends a
+     * {@code selectLimit} taken from the configured drivers (dbdrivers.xml / {@link DriverInfo}), so
+     * any other value is a SQL-injection attempt (CVE-2026-82583) and is rejected. A blank value is
+     * allowed: it routes to the safe {@link DatabaseMetaData#getColumns} path. The exception message
+     * is deliberately generic so the rejected value is not reflected back to the caller, and the
+     * built-in default drivers are always included so an empty/cleared configured list cannot
+     * disable the check (fail closed).
+     */
+    private void validateSelectLimit(String selectLimit) {
+        if (StringUtils.isBlank(selectLimit)) {
+            return;
+        }
+
+        Set<String> allowedSelectLimits = new HashSet<String>();
+        addSelectLimits(allowedSelectLimits, DriverInfo.getDefaultDrivers());
+
+        try {
+            addSelectLimits(allowedSelectLimits, configurationController.getDatabaseDrivers());
+        } catch (Exception e) {
+            // Fall back to the built-in driver list rather than failing open if the configured
+            // list cannot be read.
+            logger.warn("Could not load configured database drivers for selectLimit validation; using built-in defaults.", e);
+        }
+
+        if (!allowedSelectLimits.contains(selectLimit.trim())) {
+            logger.warn("Rejected database metadata request with a selectLimit that is not in the configured driver list.");
+            throw new MirthApiException("The provided selectLimit is not permitted.");
+        }
+    }
+
+    private void addSelectLimits(Set<String> allowedSelectLimits, List<DriverInfo> drivers) {
+        if (drivers == null) {
+            return;
+        }
+        for (DriverInfo driver : drivers) {
+            if (driver != null && driver.getSelectLimit() != null) {
+                allowedSelectLimits.add(driver.getSelectLimit().trim());
+            }
+        }
+    }
+
     /**
      * Translate the given pattern expression so that it can be used properly for searching tables
      * in the database. Multiple table name patterns are delimited by comma (,)

server/src/main/java/com/mirth/connect/plugins/datatypes/xml/XMLBatchAdaptor.java

@@ -18,6 +18,7 @@
 import java.util.Map;
 
 import javax.xml.XMLConstants;
+import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.transform.OutputKeys;
 import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerFactory;
@@ -33,6 +34,7 @@
 import org.mozilla.javascript.Context;
 import org.mozilla.javascript.Script;
 import org.mozilla.javascript.Scriptable;
+import org.w3c.dom.Document;
 import org.w3c.dom.Node;
 import org.w3c.dom.NodeList;
 import org.xml.sax.InputSource;
@@ -42,6 +44,7 @@
 import com.mirth.connect.donkey.server.message.batch.BatchMessageException;
 import com.mirth.connect.donkey.server.message.batch.BatchMessageReader;
 import com.mirth.connect.donkey.server.message.batch.BatchMessageReceiver;
+import com.mirth.connect.model.converters.DocumentSerializer;
 import com.mirth.connect.plugins.datatypes.xml.XMLBatchProperties.SplitType;
 import com.mirth.connect.server.controllers.ContextFactoryController;
 import com.mirth.connect.server.controllers.ControllerFactory;
@@ -127,7 +130,19 @@ private String getMessageFromReader() throws Exception {
 
                 XPath xpath = xPathFactory.newXPath();
 
-                nodeList = (NodeList) xpath.evaluate(query.toString(), new InputSource(bufferedReader), XPathConstants.NODESET);
+                // Parse the untrusted batch with a hardened parser before evaluating XPath, rather than
+                // letting XPath.evaluate(InputSource) build its own DOCTYPE-resolving parser (XXE,
+                // CVE-2026-82578). getSecureDocumentBuilderFactory() already sets disallow-doctype-decl;
+                // the extra features below block external entities/DTDs and entity expansion outright.
+                DocumentBuilderFactory dbf = DocumentSerializer.getSecureDocumentBuilderFactory();
+                dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
+                dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+                dbf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+                dbf.setXIncludeAware(false);
+                dbf.setExpandEntityReferences(false);
+                Document document = dbf.newDocumentBuilder().parse(new InputSource(bufferedReader));
+
+                nodeList = (NodeList) xpath.evaluate(query.toString(), document, XPathConstants.NODESET);
             }
 
             if (currentNode < nodeList.getLength()) {

server/src/main/java/com/mirth/connect/plugins/xsltstep/XsltStep.java

@@ -66,6 +66,14 @@ private String getTransformationScript() {
             script.append("tFactory = Packages.javax.xml.transform.TransformerFactory.newInstance();\n");
         }
 
+        // Harden the factory against XXE (CVE-2026-78224): enable secure processing and forbid
+        // external DTD/stylesheet access so external entities in the stylesheet or the source XML
+        // are not resolved. setAttribute is guarded because some implementations (e.g. Saxon) reject
+        // these attributes; secure processing alone still applies. Mirrors XmlProcessor.configureSecureTF.
+        script.append("tFactory.setFeature(Packages.javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true);\n");
+        script.append("try { tFactory.setAttribute(Packages.javax.xml.XMLConstants.ACCESS_EXTERNAL_DTD, ''); } catch (e) {}\n");
+        script.append("try { tFactory.setAttribute(Packages.javax.xml.XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ''); } catch (e) {}\n");
+
         script.append("xsltTemplate = new Packages.java.io.StringReader(" + template + ");\n");
         script.append("transformer = tFactory.newTransformer(new Packages.javax.xml.transform.stream.StreamSource(xsltTemplate));\n");
         script.append("sourceVar = new Packages.java.io.StringReader(" + sourceXml + ");\n");

server/src/test/java/com/mirth/connect/plugins/xsltstep/XsltStepSecurityTest.java

@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) Open Integration Engine. All rights reserved.
+ *
+ * The software in this package is published under the terms of the MPL license a copy of which has
+ * been included with this distribution in the LICENSE.txt file.
+ */
+
+package com.mirth.connect.plugins.xsltstep;
+
+import static org.junit.Assert.assertTrue;
+
+import org.junit.Test;
+
+/**
+ * Guards the XXE hardening of the XSLT transformer step (CVE-2026-78224). The step emits JavaScript
+ * that builds a TransformerFactory at runtime, so the fix lives in the generated script text.
+ */
+public class XsltStepSecurityTest {
+
+    @Test
+    public void generatedScriptHardensTransformerFactoryAgainstXxe() {
+        XsltStep step = new XsltStep();
+        step.setSourceXml("connectorMessage.getRawData()");
+        step.setResultVariable("xsltResult");
+        step.setTemplate("'<xsl:stylesheet version=\"1.0\"/>'");
+
+        String script = step.getScript(false);
+
+        assertTrue("secure processing should be enabled on the transformer factory",
+                script.contains("FEATURE_SECURE_PROCESSING"));
+        assertTrue("external DTD access should be disabled", script.contains("ACCESS_EXTERNAL_DTD"));
+        assertTrue("external stylesheet access should be disabled", script.contains("ACCESS_EXTERNAL_STYLESHEET"));
+    }
+
+    @Test
+    public void hardeningAlsoAppliedOnTheIteratorPath() throws Exception {
+        XsltStep step = new XsltStep();
+        step.setSourceXml("connectorMessage.getRawData()");
+        step.setResultVariable("xsltResult");
+        step.setTemplate("'<xsl:stylesheet version=\"1.0\"/>'");
+
+        String script = step.getIterationScript(false, new java.util.LinkedList<>());
+
+        assertTrue("secure processing should be enabled on the iterator path",
+                script.contains("FEATURE_SECURE_PROCESSING"));
+        assertTrue("external DTD access should be disabled on the iterator path",
+                script.contains("ACCESS_EXTERNAL_DTD"));
+    }
+}

smoketest/build.gradle

@@ -15,6 +15,11 @@ dependencies {
     testCompileOnly files(clientCoreJar)
     // RawMessage, Message, ConnectorMessage, MessageContent, Status, DeployedState
     testCompileOnly files(donkeyModelJar)
+    // Connector/plugin classes the security tests build channels with and call directly
+    // (DatabaseConnectorServletInterface, Table, XsltStep, XMLDataTypeProperties,
+    // VmReceiverProperties, ...). These live in the server module's main output and are present at
+    // runtime via /opt/engine/extensions; needed only to compile the tests, hence compileOnly.
+    testCompileOnly project(':server').sourceSets.main.output
     // Provided at runtime by /opt/engine/server-lib (server-main uses it too).
     testCompileOnly libs.snakeyaml
 

smoketest/src/test/java/org/openintegrationengine/smoketest/DatabaseConnectorSqlInjectionTest.java

@@ -0,0 +1,130 @@
+// SPDX-License-Identifier: MPL-2.0
+// SPDX-FileCopyrightText: 2026 Open Integration Engine
+
+package org.openintegrationengine.smoketest;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assumptions.assumeTrue;
+
+import java.util.Set;
+import java.util.SortedSet;
+
+import org.junit.jupiter.api.Test;
+
+import com.mirth.connect.connectors.jdbc.Column;
+import com.mirth.connect.connectors.jdbc.Table;
+
+/**
+ * Validates CVE-2026-82583: the Database connector {@code _getTables} endpoint executed the
+ * caller-supplied {@code selectLimit} as raw SQL.
+ *
+ * <p>
+ * The test drives the same {@code getTables} API the Database connector metadata dialog uses,
+ * against the database the CI stack already runs (coordinates passed as {@code oie.db.*} system
+ * properties). It skips on embedded-Derby configurations that expose no separate database service.
+ *
+ * <p>
+ * Pre-fix this test is RED (the injected {@code SELECT 1 AS OIE_SQLI_MARKER} runs and its alias
+ * surfaces as a column); post-fix it is GREEN (the non-allowlisted {@code selectLimit} is rejected
+ * before any SQL executes).
+ */
+class DatabaseConnectorSqlInjectionTest {
+
+    private static final String MARKER = "OIE_SQLI_MARKER";
+
+    @Test
+    void selectLimitDoesNotExecuteArbitrarySql() throws Exception {
+        Db db = Db.fromSystemProperties();
+        assumeTrue(db != null, "oie.db.* coordinates not provided; skipping (embedded-database configuration)");
+
+        OieServer server = SharedServer.get();
+
+        // Discover a real table via the safe metadata path (empty selectLimit is always allowed).
+        Table target = firstTableWithColumns(server.getConnectorTables(db.driver, db.url, db.user, db.password,
+                Set.of("%"), ""));
+        assumeTrue(target != null, "No table with columns found in the target database");
+
+        // If executed, this injected SELECT's alias becomes the sole returned column name.
+        String maliciousSelectLimit = "SELECT 1 AS " + MARKER + " FROM ?";
+        SortedSet<Table> result = null;
+        try {
+            result = server.getConnectorTables(db.driver, db.url, db.user, db.password, Set.of(target.getName()),
+                    maliciousSelectLimit);
+        } catch (Exception rejectedByAllowlist) {
+            // Post-fix: the non-allowlisted selectLimit is rejected before any SQL runs -> blocked.
+            return;
+        }
+
+        assertFalse(hasColumnNamed(result, MARKER), "selectLimit executed arbitrary SQL (returned an injected '"
+                + MARKER + "' column) -- CVE-2026-82583 is present");
+    }
+
+    @Test
+    void allowlistedSelectLimitStillReturnsColumns() throws Exception {
+        Db db = Db.fromSystemProperties();
+        assumeTrue(db != null, "oie.db.* coordinates not provided; skipping (embedded-database configuration)");
+        String allowlisted = System.getProperty("oie.db.selectLimit", "SELECT * FROM ? LIMIT 1");
+
+        OieServer server = SharedServer.get();
+        Table target = firstTableWithColumns(server.getConnectorTables(db.driver, db.url, db.user, db.password,
+                Set.of("%"), ""));
+        assumeTrue(target != null, "No table with columns found in the target database");
+
+        // The legitimate flow (a selectLimit taken from the configured driver list) must keep working.
+        SortedSet<Table> result = server.getConnectorTables(db.driver, db.url, db.user, db.password,
+                Set.of(target.getName()), allowlisted);
+        assertTrue(result.stream().anyMatch(t -> !t.getColumns().isEmpty()),
+                "An allowlisted selectLimit should still return table columns");
+        assertFalse(hasColumnNamed(result, MARKER), "Unexpected injected column from an allowlisted selectLimit");
+    }
+
+    private static Table firstTableWithColumns(SortedSet<Table> tables) {
+        for (Table table : tables) {
+            if (table.getColumns() != null && !table.getColumns().isEmpty()) {
+                return table;
+            }
+        }
+        return null;
+    }
+
+    private static boolean hasColumnNamed(SortedSet<Table> tables, String columnName) {
+        for (Table table : tables) {
+            if (table.getColumns() == null) {
+                continue;
+            }
+            for (Column column : table.getColumns()) {
+                if (columnName.equalsIgnoreCase(column.getName())) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+
+    /** DB coordinates supplied to the harness for the configuration under test. */
+    private static final class Db {
+        final String driver;
+        final String url;
+        final String user;
+        final String password;
+
+        private Db(String driver, String url, String user, String password) {
+            this.driver = driver;
+            this.url = url;
+            this.user = user;
+            this.password = password;
+        }
+
+        static Db fromSystemProperties() {
+            String driver = System.getProperty("oie.db.driver");
+            String url = System.getProperty("oie.db.url");
+            String user = System.getProperty("oie.db.user");
+            String password = System.getProperty("oie.db.password");
+            if (driver == null || url == null || user == null || password == null) {
+                return null;
+            }
+            return new Db(driver, url, user, password);
+        }
+    }
+}