Piotr Karwasz created OPENNLP-1957:
--------------------------------------
Summary: Use Apache Commons Secure XML for JAXP factory creation
Key: OPENNLP-1957
URL: https://issues.apache.org/jira/browse/OPENNLP-1957
Project: OpenNLP
Issue Type: Improvement
Reporter: Piotr Karwasz
OpenNLP has now had two XXE vulnerabilities in the same class of code:
* [CVE-2017-12620|https://www.cve.org/CVERecord?id=CVE-2017-12620]: XXE through
XML processing of untrusted models and dictionaries, fixed in 1.8.2.
* [CVE-2026-40682|https://www.cve.org/CVERecord?id=CVE-2026-40682]: XXE in
{{DictionaryEntryPersistor}}, which did not disable DTD processing, fixed in
2.5.9 and 3.0.0-M3.
The fix for the second one centralized hardening in {{XmlUtil}}, and
OPENNLP-1880 had to re-implement the same OWASP checklist by hand for its
StAX-based WN-LMF reader. Every new XML entry point repeats the same list of
vendor-specific features and properties, plus Android fallbacks, and each copy
is a place where the next CVE can slip in.
[Apache Commons Secure
XML|https://commons.apache.org/proper/commons-secure-xml]
({{org.apache.commons:commons-secure-xml}}) provides secure-by-default JAXP
factories for DOM, SAX, StAX, Schema, Transformer and XPath. It abstracts over
the differences between the stock JDK, Xerces, Woodstox, Saxon and Android, so
the "how do we securely configure this parser" question is answered once,
upstream, by a component whose purpose is exactly that.
h4. Proposal
# Replace the hand-rolled feature and property lists in {{XmlUtil}} with
{{SecureDocumentBuilderFactory}} and {{SecureSAXParserFactory}}.
# Use {{SecureXMLInputFactory}} for the StAX reader introduced by OPENNLP-1880.
# Keep {{XmlUtil}} as the single entry point so existing callers in
{{opennlp-formats}} and {{opennlp-runtime}} are unaffected.
This decentralizes security management of XML parsing: OpenNLP stops
maintaining its own hardening logic and picks up fixes for new parser features
or implementations through a dependency bump.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
