You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@struts.apache.org by "lukaszlenart (via GitHub)" <gi...@apache.org> on 2026/03/29 05:42:57 UTC
[PR] WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks [struts]
lukaszlenart opened a new pull request, #1642:
URL: https://github.com/apache/struts/pull/1642
## Summary
Fixes [WW-5621](https://issues.apache.org/jira/browse/WW-5621)
Defense-in-depth hardening of XML parsers. Modern JDKs (7u45+) already enforce a 64K entity expansion limit, so this is **not an exploitable vulnerability** — all XML sources come from the classpath, not user input.
- Remove unused `parseStringAsXML` feature from `StringAdapter` to eliminate theoretical attack surface
- Deprecate `getParseStringAsXML()` / `setParseStringAsXML()` for future removal
- Enable `FEATURE_SECURE_PROCESSING` in Tiles `DigesterDefinitionsReader`
- Add unit test verifying JDK entity expansion limit rejects Billion Laughs payloads
## Test plan
- [ ] `mvn test -DskipAssembly -pl core -Dtest=DomHelperTest` — verify Billion Laughs test passes
- [ ] `mvn test -DskipAssembly -pl plugins/xslt` — verify XSLT plugin tests pass with StringAdapter changes
- [ ] `mvn test -DskipAssembly -pl plugins/tiles` — verify Tiles plugin tests pass with SECURE_PROCESSING
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks [struts]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #1642:
URL: https://github.com/apache/struts/pull/1642#issuecomment-4149507923
## [](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1642) **Quality Gate failed**
Failed conditions
 [B Maintainability Rating on New Code](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1642) (required ≥ A)
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1642)
##
 Catch issues before they fail your Quality Gate with our IDE extension  [SonarQube for IDE](https://www.sonarsource.com/products/sonarlint/features/connected-mode/?referrer=pull-request)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks [struts]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #1642:
URL: https://github.com/apache/struts/pull/1642#issuecomment-4149502645
## [](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1642) **Quality Gate failed**
Failed conditions
 [66.7% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1642&metric=new_coverage&view=list) (required ≥ 80%)
 [C Maintainability Rating on New Code](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1642) (required ≥ A)
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1642)
##
 Catch issues before they fail your Quality Gate with our IDE extension  [SonarQube for IDE](https://www.sonarsource.com/products/sonarlint/features/connected-mode/?referrer=pull-request)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks [struts]
Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.
lukaszlenart merged PR #1642:
URL: https://github.com/apache/struts/pull/1642
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] WW-5621 Harden XML parsers against Entity Expansion (Billion Laughs) attacks [struts]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #1642:
URL: https://github.com/apache/struts/pull/1642#issuecomment-4149529536
## [](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1642) **Quality Gate failed**
Failed conditions
 [75.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_struts&pullRequest=1642&metric=new_coverage&view=list) (required ≥ 80%)
 [B Maintainability Rating on New Code](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1642) (required ≥ A)
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_struts&pullRequest=1642)
##
 Catch issues before they fail your Quality Gate with our IDE extension  [SonarQube for IDE](https://www.sonarsource.com/products/sonarlint/features/connected-mode/?referrer=pull-request)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org