(axis-axis2-c-core) 05/07: AXIS2C-1708 Modern security hardening: Fix XML parser issues found by Gemini code review

[ro...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git

commit 6e3884d39a296b66d91b4614313e3e03eb45162f
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Fri Jan 30 12:29:22 2026 -1000

    AXIS2C-1708 Modern security hardening: Fix XML parser issues found by Gemini code review
    
    Address issues identified during automated code review:
    
    1. Add error check for xmlTextReaderDepth() return value
       - Function can return negative on error
       - Now properly detect and handle error condition
    
    2. Improve security error messages for debugging:
       - XML depth exceeded: include document source/URI
       - Attribute count exceeded: include element name
    
    These changes improve debuggability when security limits
    are triggered, helping identify the source of malicious
    or malformed XML documents.
    
    Co-Authored-By: Claude Opus 4.5 <no...@anthropic.com>
---
 axiom/src/parser/libxml2/libxml2_reader_wrapper.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/axiom/src/parser/libxml2/libxml2_reader_wrapper.c b/axiom/src/parser/libxml2/libxml2_reader_wrapper.c
index 42a473179..81b7031a7 100644
--- a/axiom/src/parser/libxml2/libxml2_reader_wrapper.c
+++ b/axiom/src/parser/libxml2/libxml2_reader_wrapper.c
@@ -544,11 +544,18 @@ axis2_libxml2_reader_wrapper_next(
          * from deeply nested XML (XML bomb variant).
          */
         depth = xmlTextReaderDepth(parser_impl->reader);
+        if(depth < 0)
+        {
+            AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
+                "Error: xmlTextReaderDepth returned error (%d). Aborting parsing.", depth);
+            return -1;
+        }
         if(depth >= AXIS2_XML_MAX_DEPTH)
         {
+            const xmlChar *base_uri = xmlTextReaderConstBaseUri(parser_impl->reader);
             AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
-                "Security: XML nesting depth exceeded (%d >= %d). Possible DoS attack.",
-                depth, AXIS2_XML_MAX_DEPTH);
+                "Security: XML nesting depth exceeded (%d >= %d) in %s. Possible DoS attack.",
+                depth, AXIS2_XML_MAX_DEPTH, base_uri ? (const char*)base_uri : "unknown source");
             return -1;
         }
 
@@ -981,8 +988,10 @@ axis2_libxml2_reader_wrapper_fill_maps(
      */
     if(libxml2_attribute_count > (AXIS2_XML_MAX_ATTRIBUTES + AXIS2_XML_MAX_NAMESPACES))
     {
+        const xmlChar *elem_name = xmlTextReaderConstLocalName(parser_impl->reader);
         AXIS2_LOG_ERROR(env->log, AXIS2_LOG_SI,
-            "Security: XML element has too many attributes (%d > %d). Possible DoS attack.",
+            "Security: XML element '%s' has too many attributes (%d > %d). Possible DoS attack.",
+            elem_name ? (const char*)elem_name : "unknown",
             libxml2_attribute_count, AXIS2_XML_MAX_ATTRIBUTES + AXIS2_XML_MAX_NAMESPACES);
         AXIS2_ERROR_SET(env->error, AXIS2_ERROR_XML_PARSER_INVALID_MEM_TYPE, AXIS2_FAILURE);
         return AXIS2_FAILURE;