digi-scrypt opened a new pull request, #284: URL: https://github.com/apache/commons-jxpath/pull/284
DOMParser, JDOMParser and the deprecated XMLDocumentContainer transform path parse XML from a caller-supplied URL/Source without turning off external entities, so a document carrying an external general entity like <!ENTITY xxe SYSTEM "file:///etc/passwd"> gets resolved at parse time and its contents land in the tree, which is the usual file-read / SSRF XXE. The fix turns off external general/parameter entities and external DTD loading inside each parser while leaving the internal DTD subset working, so the existing Vendor.xml style documents still parse. One thing I went back and forth on: for JDOM the SAX feature flags alone are not enough because setExpandEntities(true) re-enables external general entities afterward, so I refuse external lookups with a no-op EntityResolver there instead. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
