[4.x.x] Improve security and configurability of functions that access the Environment and System Properties

conf.xml.tmpl

@@ -804,6 +804,31 @@
             raise-error-on-failed-retrieval="no">
 
         <builtin-modules>
+
+            <module uri="http://www.w3.org/2005/xpath-functions" class="org.exist.xquery.functions.fn.FnModule">
+
+                <!--
+                    Access to Environment Variables via the fn:available-environment-variables#0
+                    and fn:environment-variable#1 functions can be restricted for Security Purposes.
+
+                    The syntax of the parameter keys is:
+                        "environmentVariableAccess.<Name of an Environment Variable>.[requiresGroup|requiresUser]"
+
+                    If you have multiple users who wish to access the same Environment Variable, then you may
+                    add multiple parameters for the same key, e.g.:
+
+                    <parameter name="environmentVariableAccess.PATH.requiresGroup" value="dba"/>
+                    <parameter name="environmentVariableAccess.PATH.requiresGroup" value="admin"/>
+                    <parameter name="environmentVariableAccess.PATH.requiresUser" value="my-special-user"/>
+
+                    The special symbol "*", meaning "otherwise", may be used to indicate all Environment Variables
+                    which have not otherwise been specified in this config.
+                       If "*" is not set in this config, then it is set to the "DBA" group by default.
+                -->
+                <parameter name="environmentVariableAccess.*.requiresGroup" value="dba"/>
+
+            </module>
+
             <!-- 
                 Modularized Indexes 
             -->
@@ -833,6 +858,26 @@
             <module uri="http://exist-db.org/xquery/util"       class="org.exist.xquery.functions.util.UtilModule">
                 <!-- set to true to disable the util:eval functions -->
                 <parameter name="evalDisabled" value="false"/>
+
+                <!--
+                    Access to Java System Properties via the util:available-system-properties#0
+                    and util:system-property#1 functions can be restricted for Security Purposes.
+
+                    The syntax of the parameter keys is:
+                        "systemPropertyAccess.<Name of a Java System Property>.[requiresGroup|requiresUser]"
+
+                    If you have multiple users who wish to access the same System Property, then you may
+                    add multiple parameters for the same key, e.g.:
+
+                    <parameter name="systemPropertyAccess.PATH.requiresGroup" value="dba"/>
+                    <parameter name="systemPropertyAccess.PATH.requiresGroup" value="admin"/>
+                    <parameter name="systemPropertyAccess.PATH.requiresUser" value="my-special-user"/>
+
+                    The special symbol "*", meaning "otherwise", may be used to indicate all System Properties
+                    which have not otherwise been specified in this config.
+                       If "*" is not set in this config, then it is set to the "DBA" group by default.
+                -->
+                <parameter name="systemPropertyAccess.*.requiresGroup" value="dba"/>
             </module>
 
             <module uri="http://exist-db.org/xquery/validation" class="org.exist.xquery.functions.validation.ValidationModule" />

exist-core/src/main/java/org/exist/ExistSystemProperties.java

@@ -0,0 +1,67 @@
+package org.exist;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Properties;
+import java.util.Set;
+
+import com.evolvedbinary.j8fu.lazy.AtomicLazyVal;
+import net.jcip.annotations.ThreadSafe;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import javax.annotation.Nullable;
+
+/**
+ * @author <a href="mailto:[email protected]">Adam Retter</a>
+ */
+@ThreadSafe
+public class ExistSystemProperties {
+
+    public static final String PROP_PRODUCT_NAME = "product-name";
+    public static final String PROP_PRODUCT_VERSION = "product-version";
+    public static final String PROP_PRODUCT_BUILD = "product-build";
+    public static final String PROP_GIT_BRANCH = "git-branch";
+    public static final String PROP_GIT_COMMIT = "git-commit";
+
+    private static final Logger LOG = LogManager.getLogger(ExistSystemProperties.class);
+    private static final ExistSystemProperties instance = new ExistSystemProperties();
+
+    private final AtomicLazyVal<Properties> properties = new AtomicLazyVal<>(this::load);
+
+    public final static ExistSystemProperties getInstance() {
+        return instance;
+    }
+
+    private ExistSystemProperties() {
+    }
+
+    private Properties load() {
+        final Properties properties = new Properties();
+        try (final InputStream is = ExistSystemProperties.class.getResourceAsStream("system.properties")) {
+            if (is != null) {
+                properties.load(is);
+            }
+        } catch (final IOException ioe) {
+            LOG.error("Unable to load system.properties from class loader: " +  ioe.getMessage(), ioe);
+        }
+        return properties;
+    }
+
+    public @Nullable String getExistSystemProperty(final String propertyName) {
+        return properties.get().getProperty(propertyName);
+    }
+
+    public @Nullable String getExistSystemProperty(final String propertyName, @Nullable final String defaultValue) {
+        return properties.get().getProperty(propertyName, defaultValue);
+    }
+
+    /**
+     * Get the available eXist System Properties.
+     *
+     * @return the available eXist System Properties.
+     */
+    public Set<String> getAvailableExistSystemProperties() {
+        return properties.get().stringPropertyNames();
+    }
+}

exist-core/src/main/java/org/exist/Version.java

@@ -35,12 +35,12 @@ public final class Version {
 
 	static {
 
-		final SystemProperties systemProperties = SystemProperties.getInstance();
-		NAME = systemProperties.getSystemProperty("product-name", "eXist");
-		VERSION = systemProperties.getSystemProperty("product-version");
-		BUILD = systemProperties.getSystemProperty("product-build");
-		GIT_BRANCH = systemProperties.getSystemProperty("git-branch");
-		GIT_COMMIT = systemProperties.getSystemProperty("git-commit");
+		final ExistSystemProperties existSystemProperties = ExistSystemProperties.getInstance();
+		NAME = existSystemProperties.getExistSystemProperty(ExistSystemProperties.PROP_PRODUCT_NAME, "eXist");
+		VERSION = existSystemProperties.getExistSystemProperty(ExistSystemProperties.PROP_PRODUCT_VERSION);
+		BUILD = existSystemProperties.getExistSystemProperty(ExistSystemProperties.PROP_PRODUCT_BUILD);
+		GIT_BRANCH = existSystemProperties.getExistSystemProperty(ExistSystemProperties.PROP_GIT_BRANCH);
+		GIT_COMMIT = existSystemProperties.getExistSystemProperty(ExistSystemProperties.PROP_GIT_COMMIT);
 	}
 
 	public static String getProductName() {

exist-core/src/main/java/org/exist/client/ClientFrame.java

@@ -20,7 +20,7 @@
  */
 package org.exist.client;
 
-import org.exist.SystemProperties;
+import org.exist.ExistSystemProperties;
 import org.exist.backup.Backup;
 import org.exist.backup.CreateBackupDialog;
 import org.exist.backup.Restore;
@@ -1581,7 +1581,7 @@ protected static Properties getLoginData(final Properties props) {
 
         final ConnectionDialog connectionDialog = new ConnectionDialog(null, true, defaultConnectionSettings, Boolean.parseBoolean(props.getProperty(InteractiveClient.LOCAL_MODE, InteractiveClient.LOCAL_MODE_DEFAULT)), Boolean.parseBoolean(props.getProperty(InteractiveClient.NO_EMBED_MODE, InteractiveClient.NO_EMBED_MODE_DEFAULT)));
 
-        connectionDialog.setTitle(SystemProperties.getInstance().getSystemProperty("product-name", "eXist-db") + " " + SystemProperties.getInstance().getSystemProperty("product-version", "unknown") + " Database Login");
+        connectionDialog.setTitle(ExistSystemProperties.getInstance().getExistSystemProperty(ExistSystemProperties.PROP_PRODUCT_NAME, "eXist-db") + " " + ExistSystemProperties.getInstance().getExistSystemProperty("product-version", "unknown") + " Database Login");
 
         connectionDialog.addDialogCompleteWithResponseCallback(connection -> {
             properties.setProperty(InteractiveClient.USER, connection.getUsername());

exist-core/src/main/java/org/exist/client/InteractiveClient.java

@@ -41,7 +41,7 @@
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.transform.OutputKeys;
 
-import org.exist.SystemProperties;
+import org.exist.ExistSystemProperties;
 import org.exist.dom.persistent.XMLUtil;
 import org.exist.security.ACLPermission;
 import org.exist.security.Account;
@@ -2478,12 +2478,12 @@ public void printNotice() {
 
     public String getNotice() {
         final StringBuilder builder = new StringBuilder();
-        builder.append(SystemProperties.getInstance().getSystemProperty("product-name", "eXist-db"));
+        builder.append(ExistSystemProperties.getInstance().getExistSystemProperty(ExistSystemProperties.PROP_PRODUCT_NAME, "eXist-db"));
         builder.append(" version ");
-        builder.append(SystemProperties.getInstance().getSystemProperty("product-version", "unknown"));
-        if (!"".equals(SystemProperties.getInstance().getSystemProperty("git-commit", ""))) {
+        builder.append(ExistSystemProperties.getInstance().getExistSystemProperty(ExistSystemProperties.PROP_PRODUCT_VERSION, "unknown"));
+        if (!"".equals(ExistSystemProperties.getInstance().getExistSystemProperty(ExistSystemProperties.PROP_GIT_COMMIT, ""))) {
             builder.append(" (");
-            builder.append(SystemProperties.getInstance().getSystemProperty("git-commit", "(unknown Git commit ID)"));
+            builder.append(ExistSystemProperties.getInstance().getExistSystemProperty(ExistSystemProperties.PROP_GIT_COMMIT, "(unknown Git commit ID)"));
             builder.append(")");
         }
         builder.append(", Copyright (C) 2001-");

exist-core/src/main/java/org/exist/jetty/JettyStart.java

@@ -50,7 +50,7 @@
 import org.eclipse.jetty.util.component.LifeCycle;
 import org.eclipse.jetty.xml.XmlConfiguration;
 
-import org.exist.SystemProperties;
+import org.exist.ExistSystemProperties;
 import org.exist.start.Main;
 import org.exist.storage.BrokerPool;
 import org.exist.util.ConfigurationHelper;
@@ -155,9 +155,9 @@ public synchronized void run(final String[] args, final Observer observer) {
 
             logger.info("Running as user '{}'", System.getProperty("user.name", "(unknown user.name)"));
             logger.info("[eXist Home : {}]", System.getProperty("exist.home", "unknown"));
-            logger.info("[eXist Version : {}]", SystemProperties.getInstance().getSystemProperty("product-version", "unknown"));
-            logger.info("[eXist Build : {}]", SystemProperties.getInstance().getSystemProperty("product-build", "unknown"));
-            logger.info("[Git commit : {}]", SystemProperties.getInstance().getSystemProperty("git-commit", "unknown"));
+            logger.info("[eXist Version : {}]", ExistSystemProperties.getInstance().getExistSystemProperty(ExistSystemProperties.PROP_PRODUCT_VERSION, "unknown"));
+            logger.info("[eXist Build : {}]", ExistSystemProperties.getInstance().getExistSystemProperty(ExistSystemProperties.PROP_PRODUCT_BUILD, "unknown"));
+            logger.info("[Git commit : {}]", ExistSystemProperties.getInstance().getExistSystemProperty(ExistSystemProperties.PROP_GIT_COMMIT, "unknown"));
 
             logger.info("[Operating System : {} {} {}]", System.getProperty("os.name"), System.getProperty("os.version"), System.getProperty("os.arch"));
             logger.info("[log4j.configurationFile : {}]", System.getProperty("log4j.configurationFile"));

exist-core/src/main/java/org/exist/launcher/SplashScreen.java

@@ -30,7 +30,7 @@
 import java.util.Observable;
 import java.util.Observer;
 
-import org.exist.SystemProperties;
+import org.exist.ExistSystemProperties;
 
 /**
  * Display a splash screen showing the eXist-db logo and a status line.
@@ -67,10 +67,10 @@ public SplashScreen(Launcher launcher) {
         // version label
         final StringBuilder builder = new StringBuilder();
 	builder.append("Version ");
-        builder.append(SystemProperties.getInstance().getSystemProperty("product-version", "unknown"));
-	if (!"".equals(SystemProperties.getInstance().getSystemProperty("git-commit", ""))) {
+        builder.append(ExistSystemProperties.getInstance().getExistSystemProperty(ExistSystemProperties.PROP_PRODUCT_VERSION, "unknown"));
+	if (!"".equals(ExistSystemProperties.getInstance().getExistSystemProperty(ExistSystemProperties.PROP_GIT_COMMIT, ""))) {
 	    builder.append(" (");
-	    builder.append(SystemProperties.getInstance().getSystemProperty("git-commit", "(unknown Git commit ID)"));
+	    builder.append(ExistSystemProperties.getInstance().getExistSystemProperty(ExistSystemProperties.PROP_GIT_COMMIT, "(unknown Git commit ID)"));
 	    builder.append(")");
 	}
         versionLabel = new JLabel(builder.toString(), SwingConstants.CENTER);

exist-core/src/main/java/org/exist/management/impl/SystemInfo.java

@@ -24,7 +24,7 @@
 import java.io.InputStreamReader;
 import java.util.Locale;
 
-import org.exist.SystemProperties;
+import org.exist.ExistSystemProperties;
 
 /**
  * Class SystemInfo
@@ -39,12 +39,12 @@ public SystemInfo() {
 
     @Override
     public String getExistVersion() {
-        return SystemProperties.getInstance().getSystemProperty("product-version","unknown");
+        return ExistSystemProperties.getInstance().getExistSystemProperty(ExistSystemProperties.PROP_PRODUCT_VERSION,"unknown");
     }
 
     @Override
     public String getExistBuild() {
-        return SystemProperties.getInstance().getSystemProperty("product-build","unknown");
+        return ExistSystemProperties.getInstance().getExistSystemProperty(ExistSystemProperties.PROP_PRODUCT_BUILD,"unknown");
     }
 
     @Override
@@ -54,7 +54,7 @@ public String getSvnRevision() {
 
     @Override
     public String getGitCommit() {
-        return SystemProperties.getInstance().getSystemProperty("git-commit", "unknown Git commit ID");
+        return ExistSystemProperties.getInstance().getExistSystemProperty(ExistSystemProperties.PROP_GIT_COMMIT, "unknown Git commit ID");
     }
 
     @Override

exist-core/src/main/java/org/exist/repo/ClasspathHelper.java

@@ -29,7 +29,7 @@
 
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
-import org.exist.SystemProperties;
+import org.exist.ExistSystemProperties;
 import org.exist.start.Classpath;
 import org.exist.start.EXistClassLoader;
 import org.exist.storage.BrokerPool;
@@ -109,7 +109,7 @@ private static void scanPackages(BrokerPool pool, Classpath classpath) {
     private static boolean isCompatible(Package pkg) throws PackageException {
         // determine the eXist-db version this package is compatible with
         final Collection<ProcessorDependency> processorDeps = pkg.getProcessorDeps();
-        final String procVersion = SystemProperties.getInstance().getSystemProperty("product-version", "1.0");
+        final String procVersion = ExistSystemProperties.getInstance().getExistSystemProperty(ExistSystemProperties.PROP_PRODUCT_VERSION, "1.0");
         PackageLoader.Version processorVersion = DEFAULT_VERSION;
         for (ProcessorDependency dependency: processorDeps) {
             if (Deployment.PROCESSOR_NAME.equals(dependency.getProcessor())) {

exist-core/src/main/java/org/exist/repo/Deployment.java

@@ -23,7 +23,7 @@
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 import org.exist.EXistException;
-import org.exist.SystemProperties;
+import org.exist.ExistSystemProperties;
 import org.exist.collections.Collection;
 import org.exist.collections.IndexInfo;
 import org.exist.collections.triggers.TriggerException;
@@ -287,7 +287,7 @@ public Optional<String> installAndDeploy(final XarSource xar, final PackageLoade
     }
 
     private void checkProcessorVersion(final PackageLoader.Version version) throws PackageException {
-        final String procVersion = SystemProperties.getInstance().getSystemProperty("product-version", "1.0");
+        final String procVersion = ExistSystemProperties.getInstance().getExistSystemProperty(ExistSystemProperties.PROP_PRODUCT_VERSION, "1.0");
 
         final DependencyVersion depVersion = version.getDependencyVersion();
         if (!depVersion.isCompatible(procVersion)) {

exist-core/src/main/java/org/exist/util/Configuration.java

@@ -365,9 +365,6 @@ private void configureXQuery( Element xquery ) throws DatabaseConfigurationExcep
      * @throws  DatabaseConfigurationException
      */
     private void loadModuleClasses( Element xquery, Map<String, Class<?>> modulesClassMap, Map<String, String> modulesSourceMap, Map<String, Map<String, List<? extends Object>>> moduleParameters) throws DatabaseConfigurationException {
-        // add the standard function module
-        modulesClassMap.put(Namespaces.XPATH_FUNCTIONS_NS, org.exist.xquery.functions.fn.FnModule.class);
-
         // add other modules specified in configuration
         final NodeList builtins = xquery.getElementsByTagName(XQUERY_BUILTIN_MODULES_CONFIGURATION_MODULES_ELEMENT_NAME);
 
@@ -429,6 +426,11 @@ private void loadModuleClasses( Element xquery, Map<String, Class<?>> modulesCla
                 }
             }
         }
+
+        // if not specified in the conf.xml, then add the standard function module anyway
+        if (!modulesClassMap.containsKey(Namespaces.XPATH_FUNCTIONS_NS)) {
+            modulesClassMap.put(Namespaces.XPATH_FUNCTIONS_NS, org.exist.xquery.functions.fn.FnModule.class);
+        }
     }
 
     /**

exist-core/src/main/java/org/exist/webstart/JnlpWriter.java

@@ -33,7 +33,7 @@
 import org.apache.commons.io.FilenameUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
-import org.exist.SystemProperties;
+import org.exist.ExistSystemProperties;
 import org.exist.util.FileUtils;
 import org.exist.util.io.FastByteArrayOutputStream;
 
@@ -99,7 +99,7 @@ void writeJnlpXML(JnlpJarFiles jnlpFiles, HttpServletRequest request,
             writer.writeAttribute("codebase", codeBase);
             writer.writeAttribute("href", "exist.jnlp");
 
-            String version = SystemProperties.getInstance().getSystemProperty("product-version", null);
+            String version = ExistSystemProperties.getInstance().getExistSystemProperty(ExistSystemProperties.PROP_PRODUCT_VERSION, null);
             if(version!=null){
                 writer.writeAttribute("version", version);
             }