bamaer opened a new issue, #8367: URL: https://github.com/apache/hop/issues/8367
### What needs to happen? XSD validation resolves external entities unless explicitly turned off. The default comes from `ALLOW_EXTERNAL_ENTITIES_FOR_XSD_VALIDATION_DEFAULT`, which is `"true"` in both places it is defined: - `transforms/xml/.../xsdvalidator/XsdValidatorMeta.java:62` (XSD Validator transform) - `actions/xml/.../xsdvalidator/XsdValidator.java:76` (XSD Validator action) Both have the hardened configuration already implemented — a secure `SchemaFactory`, `disallow-doctype-decl`, external general and parameter entities off, and a rejecting entity resolver (transform: `XsdValidator.java:137-168`, action: `XsdValidator.java:135-166`). In both it is gated behind the flag being false, so with the current default it never runs and the unsecured `SchemaFactory` is selected instead. The fix is therefore the default value, not the implementation: change both constants to `"false"`. ### Issue Priority Priority: 2 ### Issue Component Component: Transforms -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
