[
https://issues.apache.org/jira/browse/TIKA-4935?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18119847#comment-18119847
]
ASF GitHub Bot commented on TIKA-4935:
--------------------------------------
ppkarwasz commented on code in PR #3262:
URL: https://github.com/apache/tika/pull/3262#discussion_r4115612600
##########
tika-core/src/main/java/org/apache/tika/utils/XMLReaderUtils.java:
##########
@@ -290,12 +290,8 @@ public static XMLInputFactory getXMLInputFactory() {
LOG.debug("XMLInputFactory class {}", factory.getClass());
}
- tryToSetStaxProperty(factory, XMLInputFactory.IS_NAMESPACE_AWARE,
true);
-
- //try to configure secure processing
- tryToSetStaxProperty(factory, XMLInputFactory.IS_VALIDATING, false);
+ //try to cause DTDs to throw exceptions
tryToSetStaxProperty(factory, XMLInputFactory.SUPPORT_DTD, false);
Review Comment:
I don't think the intention of #2294 was to throw whenever `DOCTYPE` is
encountered: https://github.com/apache/tika/pull/3261#discussion_r4115582847
Keeping this setting introduces a difference between the DOM / SAX and StAX
paths. Since Commons Secure XML is about delegating responsibility about
security-related configuration, I would remove all these settings,
@tballison: could you clarify the maintainers' position regarding `DOCTYPE`?
Do you want to actively ban them or are they acceptable as long as they don't
generate security issues?
> Delegate JAXP parser configuration to Apache Commons Secure XML
> ---------------------------------------------------------------
>
> Key: TIKA-4935
> URL: https://issues.apache.org/jira/browse/TIKA-4935
> Project: Tika
> Issue Type: Improvement
> Reporter: Gary D. Gregory
> Priority: Minor
> Fix For: 4.1.0
>
>
> Tika maintains custom XML security configuration across SAX, DOM, StAX, and
> XSLT processing. Adopt Apache Commons Secure XML 1.0.0 to centralize these
> protections and reduce duplicated configuration and resolver code.
> PR [3261|https://github.com/apache/tika/pull/3261]:
> * Uses Commons Secure XML factories in {{{}XMLReaderUtils{}}}, MIME type
> loading, and XML-related tests.
> * Removes manual SAX/DOM feature configuration, transformer external-access
> attributes, and the custom StAX fallback resolver.
> * Retains Tika’s configurable entity expansion limits, parser pooling, DOM
> entity-reference settings, and StAX restrictions on DTD and external entity
> processing.
> * Routes async configuration writer document and transformer creation
> through {{{}XMLReaderUtils{}}}.
> * Adds Maven dependencies and updates the OSGi integration-test setup.
> Regression tests cover external entity blocking and external resource access
> through XSLT {{{}document(){}}}, {{{}xsl:include{}}}, and {{xsl:import}} for
> both transformer factory getters. They also verify that explicitly supplied
> resolvers remain usable and that the async writer can create new XML
> configurations and preserve existing configuration content.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
