{"id":20137831,"url":"https://github.com/scdh/hardening-saxon","last_synced_at":"2026-06-05T18:31:30.620Z","repository":{"id":195550255,"uuid":"693146165","full_name":"SCDH/hardening-saxon","owner":"SCDH","description":null,"archived":false,"fork":false,"pushed_at":"2023-09-18T16:01:00.000Z","size":427,"stargazers_count":2,"open_issues_count":0,"forks_count":1,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-03-02T23:13:33.532Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SCDH.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2023-09-18T12:50:11.000Z","updated_at":"2023-10-04T03:13:59.000Z","dependencies_parsed_at":"2023-09-18T17:46:16.400Z","dependency_job_id":null,"html_url":"https://github.com/SCDH/hardening-saxon","commit_stats":null,"previous_names":["scdh/hardening-saxon"],"tags_count":6,"template":false,"template_full_name":null,"purl":"pkg:github/SCDH/hardening-saxon","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SCDH%2Fhardening-saxon","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SCDH%2Fhardening-saxon/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SCDH%2Fhardening-saxon/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SCDH%2Fhardening-saxon/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SCDH","download_url":"https://codeload.github.com/SCDH/hardening-saxon/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SCDH%2Fhardening-saxon/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33953633,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-05T02:00:06.157Z","response_time":120,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-13T21:29:49.743Z","updated_at":"2026-06-05T18:31:30.590Z","avatar_url":"https://github.com/SCDH.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Hardening Saxon\n\n![Tests](https://github.com/github/docs/actions/workflows/test.yml/badge.svg)\n![Deploy](https://github.com/github/docs/actions/workflows/deploy.yml/badge.svg)\n[![Javadoc](https://img.shields.io/badge/JavaDoc-Online-green)](https://scdh.github.io/hardening-saxon/javadoc/)\n\nRunning XSLT, XQuery and XPath bears some security risks if you do not\nknow exactly what is in a script. For example, an XPath expression may\ncontain code for stealing secrets from your computer, or an XSLT\nstylesheet may contain code for adding a login key to your ssh\nconfiguration. This project aims to make\n[Saxon](https://www.saxonica.com/) robust against such attacks by\nadding control over the access to your local file system. It does so\nby\n\n- restricting file system access through `doc(...)`, `unparsed-text(...)`\n  etc., and `\u003cxsl:result-document\u003e` to a set of allowed paths only,\n  which is defined by configuration\n\n\n## Getting started\n\nClone this repo and run `./mvnw package` (Linux/Mac) or `.\\mvnw.cmd\npackage` (Windows) in order to build the hardening classes and get\nwrapper scripts for simple usage. Then, there will be wrapper scripts\nin `target/bin/` for Linux, Mac, and Windows.\n\nYou can run the wrapper scripts from anywhere on your computer since\nthey only contain absolute paths.\n\nNote: You need a Java JDK, e.g. OpenJDK, installed on your computer\nfor running the above commands. A Maven installation is not required\nwhen building through the maven wrapper scripts `mvnw` and `mvnw.cmd`.\n\n\n## Usage\n\nIn order to restrict access to files and subfolders of the folders\n`projects` and `src/xsl` in your home folder run\n\n```{shell}\nexport SAXON_ALLOWED_PATHS=~/projects,~/src/xsl\n```\n\nOn a Windows powershell you can set allowed paths like this:\n\n```{shell}\n$env:SAXON_ALLOWED_PATHS=\"~/projects,~/src/xsl\"\n```\n\n\nThen use the wrapper scripts in `target/bin/` and the [Saxon\nconfiguration](https://www.saxonica.com/documentation10/index.html#!configuration/configuration-file)\nin `saxon.xml`. This configuration file tells Saxon to use URI\nresolvers for the various ways of accessing the file system. These URI\nresolvers restrict access to the allowed paths.\n\nIn order to run XSLT with restriction to these paths, use the\nconfiguration file like so:\n\n```{shell}\nPATH-TO/target/bin/xslt.sh -config:PATH-TO/saxon.xml -xsl:~/src/xsl/my.xsl -s:doc.xsl\n```\n\nParameters are exactly the same as for the [Saxon command line\ntool](https://www.saxonica.com/documentation10/index.html#!using-xsl/commandline).\n\nNote, that the file system locations given as command line parameters\nare not affected by the restricted access to the file system, but only\nimported or included stylesheets, documents read with `doc()` etc. or\nwith `unparsed-text()`, and locations written to with\n`\u003cxsl:result-document\u003e`.\n\nWhen trying to access a location outside of the allowed paths, errors\nlike the following are thrown:\n\n```{txt}\nError in xsl:result-document/@href on line 19 column 64 of add-key.xsl:\n   path not allowed: /home/clueck/.ssh/authorized_keys\n```\n\n## API\n\nSee the [JavaDocs](https://scdh.github.io/hardening-saxon/javadoc) of\nthis project.\n\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fscdh%2Fhardening-saxon","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fscdh%2Fhardening-saxon","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fscdh%2Fhardening-saxon/lists"}