[jira] [Updated] (CALCITE-7790) XmlFunctions: XMLTRANSFORM should parse its XML argument through the shared DocumentBuilder and set explicit JAXP external-access attributes on the TransformerFactory

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CALCITE-7790?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

ASF GitHub Bot updated CALCITE-7790:
------------------------------------
    Labels: pull-request-available  (was: )

> XmlFunctions: XMLTRANSFORM should parse its XML argument through the shared DocumentBuilder and set explicit JAXP external-access attributes on the TransformerFactory
> ----------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: CALCITE-7790
>                 URL: https://issues.apache.org/jira/browse/CALCITE-7790
>             Project: Calcite
>          Issue Type: Task
>            Reporter: Ruben Q L
>            Assignee: Ruben Q L
>            Priority: Major
>              Labels: pull-request-available
>             Fix For: 1.43.0
>
>
> {{XmlFunctions.xmlTransform}} currently hands its XML argument to {{TransformerFactory}} as a raw StreamSource wrapping a StringReader, unlike the other functions in this class ({{EXTRACT_VALUE}}, {{EXTRACT_XML}}, {{EXISTSNODE}}) which parse the XML argument through the shared, hardened {{DocumentBuilder}} set up in CALCITE-5263. This inconsistency means the DOCTYPE and entity-handling policy configured on {{DOCUMENT_BUILDER_FACTORY}} does not apply to XMLTRANSFORM; DTD and entity handling on the transform path is governed entirely by the reader defaults of whichever JAXP provider is resolved by {{TransformerFactory.newInstance()}}. Route the XML argument through {{getDocumentNode}} (as a {{DOMSource}}) so all XML inputs in {{XmlFunctions}} are parsed with the same configuration.
> Separately, the shared {{TransformerFactory}} initializer sets {{FEATURE_SECURE_PROCESSING=true}} but does not set the JAXP 1.5 attributes {{ACCESS_EXTERNAL_DTD}} and {{ACCESS_EXTERNAL_STYLESHEET}}. On the JDK's built-in transformer, secure processing already restricts those attributes to the empty string as a documented side effect, but {{TransformerFactory.newInstance()}} is a {{ServiceLoader}} lookup and may resolve a different implementation on some classpaths where that side effect does not apply. Set the attributes explicitly, and fail the initializer if the provider does not accept them (the same fail-closed pattern that {{DOCUMENT_BUILDER_FACTORY}} already uses for disallow-doctype-decl).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)