From 2db3d649ab8b9a09ebcda45042f717645d330e67 Mon Sep 17 00:00:00 2001 From: Nate Chadwick <263952448+natechadwick-intsof@users.noreply.github.com> Date: Tue, 8 Sep 2026 12:37:31 -0400 Subject: [PATCH] fix(utils): drop dead Xerces-1/Xerces-2 feature URIs from default DocumentBuilderFactory PSDocumentBuilderFactoryImpl (the project-wide default registered via PSSecureXMLUtils.setupJAXPDefaults) was setting two legacy Xerces feature URIs -- PSSecureXMLUtils.X1_GENERAL_EXTERNAL_ENTITIES_FEATURE and X2_GENERAL_EXTERNAL_ENTITIES_FEATURE -- alongside the SAX-namespace external-entity features and JAXP's FEATURE_SECURE_PROCESSING. The X1/X2 URIs are not recognized by Xerces 2.12.x. Modern Xerces consolidated the external-entity controls into the SAX-namespace features (http://xml.org/sax/features/external-general-entities and .../external-parameter-entities) and the standard JAXP FEATURE_SECURE_PROCESSING. The legacy URIs were dead code on every PSSecureXMLUtils opt-in call site too, but PSSecureXMLUtils catches the ParserConfigurationException and logs at DEBUG, so it was silent. In the default factory the catch logs at WARN, so every DocumentBuilderFactory instantiation in the project produced two WARN lines like: WARN [com.percussion.xml.PSDocumentBuilderFactoryImpl] T2.12 hardening: could not enforce X1_GENERAL_EXTERNAL_ENTITIES_FEATURE=false on DocumentBuilderFactory: Feature 'http://xerces.apache.org/xerces-j/features.html#external-general-entities' is not recognized. The startup hits PSDocumentBuilderFactoryImpl ~10 times before the webapp is fully up, so the log gets ~20 of these lines per cold start. Removing the X1/X2 setFeatureSafe calls is safe: the SAX features (SAX_GENERAL_EXTERNAL_ENTITIES_FEATURE=false, SAX_EXTERNAL_PARAMETER_ENTITIES_FEATURE=false) and FEATURE_SECURE_PROCESSING remain set in the constructor, and they are what actually disables external entity resolution on Xerces 2.12.x. disallow-doctype-decl, load-external-dtd, XIncludeAware, and expandEntityReferences are also still set. The PSSecureXMLUtils.X1/X2_GENERAL_EXTERNAL_ENTITIES_FEATURE constants remain in PSSecureXMLUtils (the opt-in path still references them with DEBUG logging) -- this change only touches the default-factory path that the T2.12 hardening PR added. The analysis doc has a post-merge revision note documenting the 3.5.x/2.12.x API surface so the URIs don't get re-added. Refs #135 > Co-Authored by Mavis Mavis-Code using MiniMax-M3 with agent mavis. --- .../135-t2-12-xerces-default-factory-hardening.md | 13 ++++++++++++- .../xml/PSDocumentBuilderFactoryImpl.java | 8 -------- 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/135-t2-12-xerces-default-factory-hardening.md b/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/135-t2-12-xerces-default-factory-hardening.md index dcd4ebfbf..a95b24117 100644 --- a/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/135-t2-12-xerces-default-factory-hardening.md +++ b/docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/issues/135-t2-12-xerces-default-factory-hardening.md @@ -17,7 +17,18 @@ Both factories are the JAXP defaults for ~100+ call sites in the project (the gr ### 1. `modules/utils/.../xml/PSDocumentBuilderFactoryImpl.java` -In the constructor, apply the same secure feature set `PSSecureXMLUtils.enableDBFFeatures` already applies, using the URI constants `PSSecureXMLUtils.DISALLOW_DOCTYPES_FEATURE`, `SAX_GENERAL_EXTERNAL_ENTITIES_FEATURE`, `X1_GENERAL_EXTERNAL_ENTITIES_FEATURE`, `X2_GENERAL_EXTERNAL_ENTITIES_FEATURE`, `SAX_EXTERNAL_PARAMETER_ENTITIES_FEATURE`, `LOAD_EXTERNAL_DTD`, and `XMLConstants.FEATURE_SECURE_PROCESSING`. Each `setFeature` call goes through a new private `setFeatureSafe(...)` helper that catches `ParserConfigurationException` and logs at WARN — missing features are treated as not-enforced rather than fatal, matching the `PSSecureXMLUtils` posture. +In the constructor, apply the same secure feature set `PSSecureXMLUtils.enableDBFFeatures` already applies, using the URI constants `PSSecureXMLUtils.DISALLOW_DOCTYPES_FEATURE`, `SAX_GENERAL_EXTERNAL_ENTITIES_FEATURE`, `SAX_EXTERNAL_PARAMETER_ENTITIES_FEATURE`, `LOAD_EXTERNAL_DTD`, and `XMLConstants.FEATURE_SECURE_PROCESSING`. Each `setFeature` call goes through a new private `setFeatureSafe(...)` helper that catches `ParserConfigurationException` and logs at WARN — missing features are treated as not-enforced rather than fatal, matching the `PSSecureXMLUtils` posture. + +> **Note (post-merge revision):** the Xerces-1 and Xerces-2 feature URIs +> (`PSSecureXMLUtils.X1_GENERAL_EXTERNAL_ENTITIES_FEATURE` / +> `X2_GENERAL_EXTERNAL_ENTITIES_FEATURE`) are not recognized by Xerces 2.12.x — +> modern Xerces consolidated the external-entity controls into the SAX-namespace +> features and JAXP's `FEATURE_SECURE_PROCESSING`. The original PR copied them +> in alongside the SAX features and emitted `WARN: T2.12 hardening: could not +> enforce X1_GENERAL_EXTERNAL_ENTITIES_FEATURE=false on DocumentBuilderFactory: +> Feature '...' is not recognized.` on every factory instantiation (×10+ at +> startup). They've been removed; the SAX-namespace features above provide the +> same control on the actual parser. Also sets `setXIncludeAware(false)` and `setExpandEntityReferences(false)` (using the `PSSecureXMLUtils.XINCLUDE_AWARE` and `EXPAND_ENTITY_REFERENCES` constants, both `false`). diff --git a/modules/utils/src/main/java/com/percussion/xml/PSDocumentBuilderFactoryImpl.java b/modules/utils/src/main/java/com/percussion/xml/PSDocumentBuilderFactoryImpl.java index 5449ee630..1c2ccb85f 100644 --- a/modules/utils/src/main/java/com/percussion/xml/PSDocumentBuilderFactoryImpl.java +++ b/modules/utils/src/main/java/com/percussion/xml/PSDocumentBuilderFactoryImpl.java @@ -67,14 +67,6 @@ public PSDocumentBuilderFactoryImpl() { PSSecureXMLUtils.SAX_GENERAL_EXTERNAL_ENTITIES_FEATURE, false, "SAX_GENERAL_EXTERNAL_ENTITIES_FEATURE"); - setFeatureSafe( - PSSecureXMLUtils.X1_GENERAL_EXTERNAL_ENTITIES_FEATURE, - false, - "X1_GENERAL_EXTERNAL_ENTITIES_FEATURE"); - setFeatureSafe( - PSSecureXMLUtils.X2_GENERAL_EXTERNAL_ENTITIES_FEATURE, - false, - "X2_GENERAL_EXTERNAL_ENTITIES_FEATURE"); setFeatureSafe( PSSecureXMLUtils.SAX_EXTERNAL_PARAMETER_ENTITIES_FEATURE, false,