You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@commons.apache.org by "ppkarwasz (via GitHub)" <gi...@apache.org> on 2026/08/31 14:20:59 UTC
[PR] Harden XML parsing via commons-secure-xml [commons-scxml]
ppkarwasz opened a new pull request, #393:
URL: https://github.com/apache/commons-scxml/pull/393
> [!WARNING]
> This PR was submitted automatically to smoke-test
> [Apache Commons Secure XML](https://github.com/apache/commons-xml)
> and has not yet been verified by a human.
> It will stay a draft until a committer reviews it and marks it ready.
Creates XML stream readers, parsers, schema factories and transformers through `org.apache.commons:commons-secure-xml` (1.0.0-SNAPSHOT until its first release). The secure factories enable XML secure processing and install a non-removable entity-resolver floor: external DTD, entity, schema and XInclude lookups that a caller-set resolver does not resolve are resolved to empty content instead of being fetched, and internal entity expansion is bounded.
- `SCXMLReader` goes through `SecureXMLInputFactory` (the `Configuration`-supplied `XMLResolver` still takes precedence, and the `factoryId`/`factoryClassLoader` override still selects the underlying implementation), plus `SecureSchemaFactory` and `SecureDocumentBuilderFactory`; `SCXMLWriter` and `ContentParser` go through `SecureTransformerFactory`.
- `ContentParser.parseXml` now wraps its argument in an `InputSource`: `DocumentBuilder.parse(String)` interprets its argument as a URI, so the method never actually parsed the XML content it was documented to parse.
- CI and CodeQL run with `-Puse-apache-snapshots` so the SNAPSHOT dependency resolves.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Harden XML parsing via commons-secure-xml [commons-scxml]
Posted by "garydgregory (via GitHub)" <gi...@apache.org>.
garydgregory commented on code in PR #393:
URL: https://github.com/apache/commons-scxml/pull/393#discussion_r3944024287
##########
src/main/java/org/apache/commons/scxml2/io/ContentParser.java:
##########
@@ -224,7 +226,8 @@ public ParsedValue parseResource(final String resourceURL) throws IOException {
public Node parseXml(final String xmlString) throws IOException {
Document doc;
try {
- doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(xmlString);
+ // Wrap in an InputSource: DocumentBuilder.parse(String) would interpret the content as a URI.
+ doc = SecureDocumentBuilderFactory.newInstance().newDocumentBuilder().parse(new InputSource(new StringReader(xmlString)));
Review Comment:
@ppkarwasz
I think we need a unit test to validate this bug fix.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Harden XML parsing via commons-secure-xml [commons-scxml]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on PR #393:
URL: https://github.com/apache/commons-scxml/pull/393#issuecomment-5631706197
This should be correct now.
In #394 I fixed the test failure on JDK 27-ea.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Harden XML parsing via commons-secure-xml [commons-scxml]
Posted by "garydgregory (via GitHub)" <gi...@apache.org>.
garydgregory commented on PR #393:
URL: https://github.com/apache/commons-scxml/pull/393#issuecomment-5591698857
Hi @ppkarwasz
If you can't get to my comment, I'll merge the PR in a bit and add a test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Harden XML parsing via commons-secure-xml [commons-scxml]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #393:
URL: https://github.com/apache/commons-scxml/pull/393#discussion_r3987280395
##########
src/main/java/org/apache/commons/scxml2/io/ContentParser.java:
##########
@@ -224,7 +226,8 @@ public ParsedValue parseResource(final String resourceURL) throws IOException {
public Node parseXml(final String xmlString) throws IOException {
Document doc;
try {
- doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(xmlString);
+ // Wrap in an InputSource: DocumentBuilder.parse(String) would interpret the content as a URI.
+ doc = SecureDocumentBuilderFactory.newInstance().newDocumentBuilder().parse(new InputSource(new StringReader(xmlString)));
Review Comment:
I added a test in https://github.com/apache/commons-scxml/pull/393/commits/5b1f1901a086d8ce26d76fcd73aea17f879b42d0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Harden XML parsing via commons-secure-xml [commons-scxml]
Posted by "garydgregory (via GitHub)" <gi...@apache.org>.
garydgregory merged PR #393:
URL: https://github.com/apache/commons-scxml/pull/393
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org