You are viewing a plain text version of this content. The canonical link for it is here.
Posted to j-dev@xerces.apache.org by "raboof (via GitHub)" <gi...@apache.org> on 2025/03/19 11:06:57 UTC
[PR] website: add security page [xerces-j]
raboof opened a new pull request, #8:
URL: https://github.com/apache/xerces-j/pull/8
Based on https://xalan.apache.org/
Should we add similar wording as on https://xerces.apache.org/xerces-c/secadv.html or is Xerces-J in better shape?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-dev-help@xerces.apache.org
Re: [PR] website: add security page [xerces-j]
Posted by "elharo (via GitHub)" <gi...@apache.org>.
elharo commented on code in PR #8:
URL: https://github.com/apache/xerces-j/pull/8#discussion_r2003543419
##########
docs/security.xml:
##########
@@ -0,0 +1,30 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!--
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+-->
+<!DOCTYPE s1 SYSTEM 'dtd/document.dtd'>
+<s1 title="Security">
+<s2 title="Security Model">
+
+By default, Xerces does what the XML specifications require. In some cases, this may not be appropriate behavior when working with untrusted input. There are multiple methods for blocking access to external entities and for disallowing DOCTYPE declarations, and it is up to the downstream user of Xerces-J to block/reject these constructs where appropriate.
+
+</s2>
+<s2 title="Reporting">
+
+If you think you have found a security issue in Apache Xerces, please follow the <jump href='https://security.apache.org/report-code'>reporting guidelines</jump>.
Review Comment:
It's worth adding a bit about not blindly reporting what static analyzers say as they're particularly bad at handling XML parsers. Adapted from the general guidelines:
"Results from source code security analyzers are not accepted without additional analysis showing that the problem indeed violates the project's security model, as such tools commonly produce many false positives."
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-dev-help@xerces.apache.org
Re: [PR] website: add security page [xerces-j]
Posted by "raboof (via GitHub)" <gi...@apache.org>.
raboof commented on code in PR #8:
URL: https://github.com/apache/xerces-j/pull/8#discussion_r2003696117
##########
docs/security.xml:
##########
@@ -0,0 +1,30 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!--
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+-->
+<!DOCTYPE s1 SYSTEM 'dtd/document.dtd'>
+<s1 title="Security">
+<s2 title="Security Model">
+
+By default, Xerces does what the XML specifications require. In some cases, this may not be appropriate behavior when working with untrusted input. There are multiple methods for blocking access to external entities and for disallowing DOCTYPE declarations, and it is up to the downstream user of Xerces-J to block/reject these constructs where appropriate.
+
+</s2>
+<s2 title="Reporting">
+
+If you think you have found a security issue in Apache Xerces, please follow the <jump href='https://security.apache.org/report-code'>reporting guidelines</jump>.
Review Comment:
good idea, added
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-dev-help@xerces.apache.org
Re: [PR] website: add security page [xerces-j]
Posted by "mrglavas (via GitHub)" <gi...@apache.org>.
mrglavas commented on PR #8:
URL: https://github.com/apache/xerces-j/pull/8#issuecomment-2737435938
> Seems like a good idea. Practically what happens once a report is submitted to [security@apache.org](mailto:security@apache.org)? Who is contacted? Who will deal with it?
>
> Currently Xerces has one very occasional committer/maintainer, and there doesn't seem to be any effort or will to expand that pool. Does Apache have a process in place to emergency push a release when the project's maintainers are unavailable or non-existent?
Valid security issues when they've been reported against Xerces-J have been addressed. We've been responsive to `security@apache.org` when an action is requi
> Seems like a good idea. Practically what happens once a report is submitted to [security@apache.org](mailto:security@apache.org)? Who is contacted? Who will deal with it?
>
> Currently Xerces has one very occasional committer/maintainer, and there doesn't seem to be any effort or will to expand that pool.
This has always been a challenge. I think we have a very niche set of skills and that can be a bit of a barrier to someone less experienced. I'm +1 to just about anyone who is serious about contributing and becoming a committer / PMC member, but have found in the past when folks want something (specifically thinking about all those requests from the community about Xerces and Maven) and are asked to volunteer they don't step up.
> Does Apache have a process in place to emergency push a release when the project's maintainers are unavailable or non-existent?
We've responded to valid security issues. I recall fixing the most recent one in the scanner and that was released in Xerces-J 2.12.2.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-dev-help@xerces.apache.org
Re: [PR] website: add security page [xerces-j]
Posted by "mukulga (via GitHub)" <gi...@apache.org>.
mukulga commented on PR #8:
URL: https://github.com/apache/xerces-j/pull/8#issuecomment-2824093047
> > Apologies for little delay to merge this PR. I'm now doing that. Many thanks for the efforts.
>
> Awesome, thanks! Now to publish this, I think someone needs to manually apply the results to https://svn.apache.org/repos/asf/xerces/site/trunk and push, right? Can anyone do that or shall I have a look?
I've committed these corrections to Xerces-J's site.
Many thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-dev-help@xerces.apache.org
Re: [PR] website: add security page [xerces-j]
Posted by "raboof (via GitHub)" <gi...@apache.org>.
raboof commented on PR #8:
URL: https://github.com/apache/xerces-j/pull/8#issuecomment-2820904071
Pretty please?
If this is just a rights issue, should I find someone from Infra to help merge this PR?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-dev-help@xerces.apache.org
Re: [PR] website: add security page [xerces-j]
Posted by "raboof (via GitHub)" <gi...@apache.org>.
raboof commented on PR #8:
URL: https://github.com/apache/xerces-j/pull/8#issuecomment-2736782903
> Seems like a good idea. Practically what happens once a report is submitted to [security@apache.org](mailto:security@apache.org)? Who is contacted? Who will deal with it?
The process is described at https://apache.org/security/committers.html - the security team will do an initial triage, and when the report appears legitimate, respond with a receipt confirmation and forward it to the projects' private list for the PMC to deal with further.
> Currently Xerces has one very occasional committer/maintainer, and there doesn't seem to be any effort or will to expand that pool. Does Apache have a process in place to emergency push a release when the project's maintainers are unavailable or non-existent?
In case of a Log4shell-scale event the security team does have the required access and mandate to push an emergency release (though no doubt it'll be challenging in practice). In 99.9% of cases this would fall on the PMC and surrounding community, though. If the PMC can no longer responsibly deal with security issues then they should flag that in their board reports and move themselves to the attic.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-dev-help@xerces.apache.org
Re: [PR] website: add security page [xerces-j]
Posted by "garydgregory (via GitHub)" <gi...@apache.org>.
garydgregory commented on PR #8:
URL: https://github.com/apache/xerces-j/pull/8#issuecomment-2736902799
I would make the distinction between Xerces and Xalan more obvious or maybe even not mention Xerces at all, which is a separate project.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-dev-help@xerces.apache.org
Re: [PR] website: add security page [xerces-j]
Posted by "mukulga (via GitHub)" <gi...@apache.org>.
mukulga commented on PR #8:
URL: https://github.com/apache/xerces-j/pull/8#issuecomment-2821240170
Apologies for little delay to merge this PR. I'm now doing that. Many thanks for the efforts.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-dev-help@xerces.apache.org
Re: [PR] website: add security page [xerces-j]
Posted by "mukulga (via GitHub)" <gi...@apache.org>.
mukulga merged PR #8:
URL: https://github.com/apache/xerces-j/pull/8
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-dev-help@xerces.apache.org
Re: [PR] website: add security page [xerces-j]
Posted by "raboof (via GitHub)" <gi...@apache.org>.
raboof commented on PR #8:
URL: https://github.com/apache/xerces-j/pull/8#issuecomment-2736925192
> I would make the distinction between Xerces and Xalan more obvious or maybe even not mention Xerces at all, which is a separate project.
makes sense, updated to not mention Xalan at all :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-dev-help@xerces.apache.org
Re: [PR] website: add security page [xerces-j]
Posted by "raboof (via GitHub)" <gi...@apache.org>.
raboof commented on PR #8:
URL: https://github.com/apache/xerces-j/pull/8#issuecomment-2824157657
I see it's now live, thanks a lot!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-dev-help@xerces.apache.org
Re: [PR] website: add security page [xerces-j]
Posted by "raboof (via GitHub)" <gi...@apache.org>.
raboof commented on PR #8:
URL: https://github.com/apache/xerces-j/pull/8#issuecomment-2821298298
> Apologies for little delay to merge this PR. I'm now doing that. Many thanks for the efforts.
Awesome, thanks! Now to publish this, I think someone needs to manually apply the results to https://svn.apache.org/repos/asf/xerces/site/trunk and push, right? Can anyone do that or shall I have a look?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-dev-help@xerces.apache.org
Re: [PR] website: add security page [xerces-j]
Posted by "raboof (via GitHub)" <gi...@apache.org>.
raboof commented on PR #8:
URL: https://github.com/apache/xerces-j/pull/8#issuecomment-2775829647
Is this just waiting for someone to hit 'merge'? Perhaps @mukulga ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-dev-help@xerces.apache.org