YLChen-007 opened a new issue, #12120:
URL: https://github.com/apache/cloudstack/issues/12120
### Description
While reviewing the codebase, I noticed that `ParserUtils` (located at
`utils/src/main/java/org/apache/cloudstack/utils/security/ParserUtils.java`)
provides secure factory methods for XML parsing. However, there are still
several places in the codebase where `DocumentBuilderFactory` and
`SAXParserFactory` are instantiated directly without using these wrapper
methods.
To improve code consistency and enhance security hardening (specifically
against XXE), we should standardize the XML parsing logic by replacing raw
factory instantiations with the methods provided in `ParserUtils`.
### Affected Components & Locations
I have identified the following locations that need refactoring:
1. **KVM Hypervisor Module**
* File:
`plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtMigrateVolumeCommandWrapper.java`
* Lines: around 219-221 and 233-235
* Current usage: `DocumentBuilderFactory.newInstance()`
2. **Database Configuration Module**
* File: `server/src/main/java/com/cloud/test/DatabaseConfig.java`
* Lines: around 432-441
* Current usage: `SAXParserFactory.newInstance()`
3. **Test Classes (Optional but recommended for consistency)**
* `LibvirtComputingResourceTest.java`
* `LibvirtMigrateCommandWrapperTest.java`
### Proposed Changes
The code should be updated to use the safer factory methods.
**For `LibvirtMigrateVolumeCommandWrapper.java`:**
```java
// Before
DocumentBuilderFactory dbFactory = DocumentBuilderFactory.newInstance();
// After
DocumentBuilderFactory dbFactory =
ParserUtils.getSaferDocumentBuilderFactory();
```
**For `DatabaseConfig.java`:**
```java
// Before
SAXParserFactory spfactory = SAXParserFactory.newInstance();
// After
SAXParserFactory spfactory = ParserUtils.getSaferSAXParserFactory();
```
### Benefits
* **Consistency:** Ensures all XML parsing follows the same pattern across
the project.
* **Security:** `ParserUtils` automatically handles security features
(disabling external entities, etc.), reducing the risk of potential XXE issues.
* **Maintainability:** Centralizes XML parser configuration in one utility
class.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
