[jira] [Created] (OFBIZ-13717) UtilXml position-tracking parse does not apply an entity-expansion limit

["Mridul Pathak (Jira)" <ji...@apache.org>]

Mridul Pathak created OFBIZ-13717:
-------------------------------------

             Summary: UtilXml position-tracking parse does not apply an entity-expansion limit
                 Key: OFBIZ-13717
                 URL: https://issues.apache.org/jira/browse/OFBIZ-13717
             Project: OFBiz
          Issue Type: Bug
          Components: framework/base
    Affects Versions: Upcoming Branch, 24.09.08
            Reporter: Mridul Pathak
            Assignee: Mridul Pathak


The withPosition variant of UtilXml.readXmlDocument() (used when line/column
position tracking is requested) parses with a raw Xerces DOMParser. It sets the
external-entity features but, unlike the other UtilXml parsers, does not apply
an entity-expansion limit. The standard readXmlDocument() path obtains this
limit through FEATURE_SECURE_PROCESSING on its DocumentBuilderFactory; the
position-tracking path has no equivalent, so a document with nested internal
entity definitions can expand without bound during parsing.

FEATURE_SECURE_PROCESSING is not recognized by the raw Xerces DOMParser, and
disallowing DOCTYPE declarations is not an option on this path because it
validates documents that legitimately declare a DOCTYPE. The expansion limit
should instead be applied via the Xerces security manager
({{org.apache.xerces.util.SecurityManager}}), whose default entity-expansion
limit (100000) matches the limit already enforced on the standard path.



--
This message was sent by Atlassian Jira
(v10.3.26#10030026)