ramanathan1504 commented on code in PR #4264:
URL: https://github.com/apache/logging-log4j2/pull/4264#discussion_r3889305074
##########
log4j-1.2-api/src/main/java/org/apache/log4j/xml/XmlConfiguration.java:
##########
@@ -131,7 +147,8 @@ public void doConfigure() throws FactoryConfigurationError {
@Override
@SuppressFBWarnings(
value = "XXE_DOCUMENT",
- justification = "The `DocumentBuilder` is configured to
not resolve external entities.")
+ justification =
+ "External entities are resolved by
`Log4jEntityResolver` through `ConfigurationSource`, which restricts their
locations to the protocols allowed by the
`log4j2.Configuration.allowedProtocols` property.")
Review Comment:
`ConfigurationSource.fromUri` returns a `FileInputStream` for `file:` and
schemeless URIs and a classloader resource for `classloader:`/`classpath:`
ones, all before `UrlConnectionFactory` is reached — so the allowlist only
covers the URL branch, and a `file:` entity still resolves with
`log4j2.Configuration.allowedProtocols=_none`.
```suggestion
"External entities are resolved by
`Log4jEntityResolver` through `ConfigurationSource`, the same way the
configuration file itself is resolved. Configuration files must come from
trusted sources.")
```
##########
src/site/antora/modules/ROOT/partials/manual/configuration-xml-format.adoc:
##########
@@ -18,6 +18,17 @@
[id=xml-features]
= XML format
+Log4j 2 parses XML configuration files with the following parser features:
+
+* DTD validation and the retrieval of external DTDs and external entities are
**disabled**.
Review Comment:
The parser also sets `setExpandEntityReferences(false)`, and
`XmlConfiguration` only walks `Element`/`Text` children — so an *internal*
entity in element content is dropped without a warning, which is worth stating
here given the migration guide in this same diff tells Log4j 1 users to inline
their entities.
```suggestion
* DTD validation and the retrieval of external DTDs and external entities
are **disabled**, and entity references are not expanded.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
