docker-compose.yml

services:
  # Tika with Woodstox (NOT vulnerable - Woodstox correctly handles XMLResolver)
  tika-with-woodstox:
    build:
      context: ./vulnerable-tika
      dockerfile: Dockerfile
    container_name: tika-with-woodstox
    ports:
      - "9998:9998"
    networks:
      - vuln-network
    restart: unless-stopped

  # VULNERABLE Tika - JDK StAX parser only (no Woodstox)
  # This simulates embedded deployments that don't have Woodstox on classpath
  tika-vulnerable:
    build:
      context: ./vulnerable-tika
      dockerfile: Dockerfile.jdk-stax
    container_name: tika-vulnerable
    ports:
      - "9997:9998"
    networks:
      - vuln-network
    restart: unless-stopped

  # Demo Web Application (file upload service using Tika)
  webapp:
    build:
      context: ./webapp
      dockerfile: Dockerfile
    container_name: webapp-cve-2025-66516
    ports:
      - "8080:8080"
    environment:
      - TIKA_SERVER_URL=http://tika-vulnerable:9998
    depends_on:
      - tika-vulnerable
      - tika-with-woodstox
    networks:
      - vuln-network
    volumes:
      - ./webapp/uploads:/app/uploads
      - ./webapp/secrets:/app/secrets:ro
    restart: unless-stopped

  # Attacker's listener server (to receive exfiltrated data)
  attacker-listener:
    image: python:3.11-slim
    container_name: attacker-listener
    ports:
      - "9999:9999"
    networks:
      - vuln-network
    working_dir: /listener
    volumes:
      - ./attacker:/listener
    command: python -m http.server 9999
    restart: unless-stopped

networks:
  vuln-network:
    driver: bridge