ppkarwasz opened a new pull request, #12309: URL: https://github.com/apache/seatunnel/pull/12309
### Purpose of this pull request Follow-up to #11250, which hardened `XmlReadStrategy` by hand against XXE. This PR replaces that hand-written hardening with a reader obtained from [Apache Commons Secure XML](https://commons.apache.org/proper/commons-secure-xml/), and adds a [forbidden-apis](https://github.com/policeman-tools/forbidden-apis) check to every module so that no code can create a JAXP factory (or a dom4j `SAXReader` with its own parser) directly. The two remaining test-scope call sites in `seatunnel-ci-tools` and `seatunnel-e2e-common` are migrated as well. ### How this differs from #11250 - **DOCTYPE declarations are tolerated again.** #11250 rejected every `<!DOCTYPE>`, including the common case of a declaration that merely points to an external DTD, or that only defines internal entities. For example these declarations parse: ```xml <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd";> <!DOCTYPE article PUBLIC "-//NLM//DTD JATS (Z39.96) Journal Archiving and Interchange DTD v1.2 20190208//EN" "JATS-archivearticle1.dtd"> <!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd";> <!DOCTYPE ONIXMessage SYSTEM "http://www.editeur.org/onix/2.1/reference/onix-international.dtd";> ``` External DTDs and entities are simply never fetched and resolve to empty content. The incompatible-changes entry is downgraded from a breaking change to a behavior change accordingly. - **The XXE protection is no longer SeaTunnel's to maintain.** The set of features and resolvers needed to secure a parser differs per JAXP implementation and changes over time. Commons Secure XML owns that recipe, ships a documented [threat model](https://commons.apache.org/proper/commons-secure-xml/threat_model.html), and is where reports about the protections themselves belong. SeaTunnel only has to make sure every parser comes from it, which the forbidden-apis check enforces at build time. ### Does this PR introduce _any_ user-facing change? XML files with a `DOCTYPE` declaration are accepted again, as long as they do not rely on external content. Documented in `docs/*/introduction/concepts/incompatible-changes.md` and the eight file-source connector pages. The Chinese pages carry a `FIXME` placeholder with the English text; a proposed translation is below for a Mandarin-speaking maintainer to vet. ### How was this patch tested? - `XmlReadStrategyTest` gains two tests: an external entity in element content resolves to an empty string while an internal entity in the same `DOCTYPE` still expands, and an external DTD subset pointing at a malformed file is not fetched. - Full `./mvnw verify` with unit and integration tests skipped: forbidden-apis scanned every module's main and test classes with zero violations. ### Check list * [x] Code changed are covered with tests, or it does not need tests for reason * [x] If any new Jar binary package adding in your PR, please add License Notice according [New License Guide](https://github.com/apache/seatunnel/blob/dev/docs/en/contribution/new-license.md) * [x] If necessary, please update the documentation to describe the new feature. * [x] Update Release Note 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
