Re: [PR] Harden XML parsing via commons-xml [commons-configuration]

["garydgregory (via GitHub)" <gi...@apache.org>]

garydgregory commented on code in PR #647:
URL: https://github.com/apache/commons-configuration/pull/647#discussion_r3943983596


##########
src/main/java/org/apache/commons/configuration2/XMLConfiguration.java:
##########
@@ -693,12 +695,26 @@ protected DocumentBuilder createDocumentBuilder() throws ParserConfigurationExce
         if (getDocumentBuilder() != null) {
             return getDocumentBuilder();
         }
-        final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+        final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance();
         if (isValidating()) {
             factory.setValidating(true);
             if (isSchemaValidation()) {
                 factory.setNamespaceAware(true);
                 factory.setAttribute(JAXP_SCHEMA_LANGUAGE, W3C_XML_SCHEMA);
+                try {
+                    // Due to a bug, the JDK fails to mark schema documents supplied by an entity resolver as resolver-created,
+                    // so the accessExternalSchema check is applied to them and denies access:
+                    //
+                    // - Old JDK 8 versions never mark them.
+                    // - Newer JDK 8 and later versions only fail to mark documents supplied by an EntityResolver2.
+                    //
+                    // Allowing all protocols only stops that check from refusing the documents returned by the resolver:
+                    // the parser never retrieves a schema itself, because the Commons XML ignore-all resolver floor
+                    // resolves every lookup the caller-supplied resolver leaves unresolved to empty content.
+                    factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "all");

Review Comment:
   @ppkarwasz 
   Isn't this handled by the library now?
   



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org