(lucene) branch main updated: Disable external entities in hyphenation PatternParser (#16135)

[us...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

uschindler pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/lucene.git


The following commit(s) were added to refs/heads/main by this push:
     new c8f8b9a152b Disable external entities in hyphenation PatternParser (#16135)
c8f8b9a152b is described below

commit c8f8b9a152b357bb3c615f3ba04c75a2864e9301
Author: metsw24-max <me...@gmail.com>
AuthorDate: Sat May 30 18:52:44 2026 +0530

    Disable external entities in hyphenation PatternParser (#16135)
    
    
    Co-authored-by: Uwe Schindler <us...@apache.org>
---
 lucene/CHANGES.txt                                 |  2 +
 .../compound/hyphenation/PatternParser.java        | 10 ++-
 .../compound/hyphenation/TestPatternParser.java    | 80 ++++++++++++++++++++++
 3 files changed, 90 insertions(+), 2 deletions(-)

diff --git a/lucene/CHANGES.txt b/lucene/CHANGES.txt
index 82ca28f6406..cbd3678a206 100644
--- a/lucene/CHANGES.txt
+++ b/lucene/CHANGES.txt
@@ -556,6 +556,8 @@ Other
 
 * GITHUB#16118: Remove getOrAddPerField calls in processBatch. (Tim Brooks)
 
+* GITHUB##16135: Disable external entities in hyphenation PatternParser. (metsw24-max, Uwe Schindler)
+
 ======================= Lucene 10.4.0 =======================
 
 API Changes
diff --git a/lucene/analysis/common/src/java/org/apache/lucene/analysis/compound/hyphenation/PatternParser.java b/lucene/analysis/common/src/java/org/apache/lucene/analysis/compound/hyphenation/PatternParser.java
index c6865e3baa2..d10428116f0 100644
--- a/lucene/analysis/common/src/java/org/apache/lucene/analysis/compound/hyphenation/PatternParser.java
+++ b/lucene/analysis/common/src/java/org/apache/lucene/analysis/compound/hyphenation/PatternParser.java
@@ -18,6 +18,7 @@ package org.apache.lucene.analysis.compound.hyphenation;
 
 import java.io.IOException;
 import java.util.ArrayList;
+import java.util.Locale;
 import javax.xml.parsers.SAXParserFactory;
 import org.xml.sax.Attributes;
 import org.xml.sax.InputSource;
@@ -233,14 +234,19 @@ public class PatternParser extends DefaultHandler {
   // EntityResolver methods
   //
   @Override
-  public InputSource resolveEntity(String publicId, String systemId) {
+  public InputSource resolveEntity(String publicId, String systemId) throws SAXException {
     // supply the internal hyphenation.dtd if possible
     if ((systemId != null && systemId.matches("(?i).*\\bhyphenation.dtd\\b.*"))
         || ("hyphenation-info".equals(publicId))) {
       // System.out.println(this.getClass().getResource("hyphenation.dtd").toExternalForm());
       return new InputSource(this.getClass().getResource("hyphenation.dtd").toExternalForm());
     }
-    return null;
+    throw new SAXException(
+        String.format(
+            Locale.ENGLISH,
+            "External Entity resolving unsupported:  publicId=\"%s\" systemId=\"%s\"",
+            publicId,
+            systemId));
   }
 
   //
diff --git a/lucene/analysis/common/src/test/org/apache/lucene/analysis/compound/hyphenation/TestPatternParser.java b/lucene/analysis/common/src/test/org/apache/lucene/analysis/compound/hyphenation/TestPatternParser.java
new file mode 100644
index 00000000000..9b2def8ef5a
--- /dev/null
+++ b/lucene/analysis/common/src/test/org/apache/lucene/analysis/compound/hyphenation/TestPatternParser.java
@@ -0,0 +1,80 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.lucene.analysis.compound.hyphenation;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import org.apache.lucene.tests.util.LuceneTestCase;
+import org.xml.sax.InputSource;
+import org.xml.sax.SAXException;
+
+public class TestPatternParser extends LuceneTestCase {
+
+  /** Collects everything the parser hands to the consumer so we can inspect it. */
+  private static class CollectingConsumer implements PatternConsumer {
+    final StringBuilder collected = new StringBuilder();
+
+    @Override
+    public void addClass(String chargroup) {
+      collected.append(chargroup);
+    }
+
+    @Override
+    public void addException(String word, ArrayList<Object> hyphenatedword) {
+      collected.append(word);
+    }
+
+    @Override
+    public void addPattern(String pattern, String values) {
+      collected.append(pattern);
+    }
+  }
+
+  public void testExternalEntityIsNotExpanded() throws Exception {
+    Path dir = createTempDir();
+    Path secret = dir.resolve("secret.txt");
+    String marker = "SUPERSECRETMARKER";
+    Files.write(secret, marker.getBytes(StandardCharsets.UTF_8));
+
+    Path evil = dir.resolve("evil.xml");
+    Files.write(
+        evil,
+        ("<?xml version=\"1.0\" encoding=\"utf-8\"?>\n"
+                + "<!DOCTYPE hyphenation-info [\n"
+                + "  <!ENTITY xxe SYSTEM \""
+                + secret.toUri()
+                + "\">\n"
+                + "]>\n"
+                + "<hyphenation-info>\n"
+                + "<classes>aA</classes>\n"
+                + "<patterns>&xxe;</patterns>\n"
+                + "</hyphenation-info>\n")
+            .getBytes(StandardCharsets.UTF_8));
+
+    CollectingConsumer consumer = new CollectingConsumer();
+    PatternParser parser = new PatternParser(consumer);
+    var e =
+        expectThrows(
+            IOException.class, () -> parser.parse(new InputSource(evil.toUri().toString())));
+    assertTrue(e.getCause() instanceof SAXException);
+    assertTrue(e.getMessage().contains("External Entity resolving unsupported"));
+    assertTrue(e.getMessage().contains("secret.txt"));
+  }
+}