[jira] [Commented] (TIKA-4938) Migrate xfa parsing from stax to sax and cherry-pick back to 3.x

["Tim Allison (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/TIKA-4938?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18120154#comment-18120154 ] 

Tim Allison commented on TIKA-4938:
-----------------------------------

Separately, shout out to [~ggregory] for his work on: https://issues.apache.org/jira/browse/TIKA-4935 

> Migrate xfa parsing from stax to sax and cherry-pick back to 3.x
> ----------------------------------------------------------------
>
>                 Key: TIKA-4938
>                 URL: https://issues.apache.org/jira/browse/TIKA-4938
>             Project: Tika
>          Issue Type: Task
>            Reporter: Tim Allison
>            Priority: Minor
>
> CVE-2025-66516 was caused by finicky behavior in the JVM around return types for external entity handling in the stax parser. We found further differential behavior if woodstox is on the classpath (which it is in tika-server).
> On this ticket, I propose simplifying our parsing of xfa and our parser configuration and moving xfa parsing to sax. We should deprecate the stax handling in XMLReaderUtils and try to keep any new xml parsing to SAX or DOM (only if necessary).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)