Skip to content

fix(utils): drop dead Xerces-1/Xerces-2 feature URIs from default DocumentBuilderFactory #205

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
natechadwick merged 1 commit into from
Sep 8, 2026
Merged

fix(utils): drop dead Xerces-1/Xerces-2 feature URIs from default DocumentBuilderFactory #205

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion ...dencyVulnerabilityAnalysis/issues/135-t2-12-xerces-default-factory-hardening.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,18 @@ Both factories are the JAXP defaults for ~100+ call sites in the project (the gr

### 1. `modules/utils/.../xml/PSDocumentBuilderFactoryImpl.java`

In the constructor, apply the same secure feature set `PSSecureXMLUtils.enableDBFFeatures` already applies, using the URI constants `PSSecureXMLUtils.DISALLOW_DOCTYPES_FEATURE`, `SAX_GENERAL_EXTERNAL_ENTITIES_FEATURE`, `X1_GENERAL_EXTERNAL_ENTITIES_FEATURE`, `X2_GENERAL_EXTERNAL_ENTITIES_FEATURE`, `SAX_EXTERNAL_PARAMETER_ENTITIES_FEATURE`, `LOAD_EXTERNAL_DTD`, and `XMLConstants.FEATURE_SECURE_PROCESSING`. Each `setFeature` call goes through a new private `setFeatureSafe(...)` helper that catches `ParserConfigurationException` and logs at WARN — missing features are treated as not-enforced rather than fatal, matching the `PSSecureXMLUtils` posture.
In the constructor, apply the same secure feature set `PSSecureXMLUtils.enableDBFFeatures` already applies, using the URI constants `PSSecureXMLUtils.DISALLOW_DOCTYPES_FEATURE`, `SAX_GENERAL_EXTERNAL_ENTITIES_FEATURE`, `SAX_EXTERNAL_PARAMETER_ENTITIES_FEATURE`, `LOAD_EXTERNAL_DTD`, and `XMLConstants.FEATURE_SECURE_PROCESSING`. Each `setFeature` call goes through a new private `setFeatureSafe(...)` helper that catches `ParserConfigurationException` and logs at WARN — missing features are treated as not-enforced rather than fatal, matching the `PSSecureXMLUtils` posture.

> **Note (post-merge revision):** the Xerces-1 and Xerces-2 feature URIs
> (`PSSecureXMLUtils.X1_GENERAL_EXTERNAL_ENTITIES_FEATURE` /
> `X2_GENERAL_EXTERNAL_ENTITIES_FEATURE`) are not recognized by Xerces 2.12.x —
> modern Xerces consolidated the external-entity controls into the SAX-namespace
> features and JAXP's `FEATURE_SECURE_PROCESSING`. The original PR copied them
> in alongside the SAX features and emitted `WARN: T2.12 hardening: could not
> enforce X1_GENERAL_EXTERNAL_ENTITIES_FEATURE=false on DocumentBuilderFactory:
> Feature '...' is not recognized.` on every factory instantiation (×10+ at
> startup). They've been removed; the SAX-namespace features above provide the
> same control on the actual parser.

Also sets `setXIncludeAware(false)` and `setExpandEntityReferences(false)` (using the `PSSecureXMLUtils.XINCLUDE_AWARE` and `EXPAND_ENTITY_REFERENCES` constants, both `false`).

Expand Down
8 changes: 0 additions & 8 deletions modules/utils/src/main/java/com/percussion/xml/PSDocumentBuilderFactoryImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,14 +67,6 @@ public PSDocumentBuilderFactoryImpl() {
PSSecureXMLUtils.SAX_GENERAL_EXTERNAL_ENTITIES_FEATURE,
false,
"SAX_GENERAL_EXTERNAL_ENTITIES_FEATURE");
setFeatureSafe(
PSSecureXMLUtils.X1_GENERAL_EXTERNAL_ENTITIES_FEATURE,
false,
"X1_GENERAL_EXTERNAL_ENTITIES_FEATURE");
setFeatureSafe(
PSSecureXMLUtils.X2_GENERAL_EXTERNAL_ENTITIES_FEATURE,
false,
"X2_GENERAL_EXTERNAL_ENTITIES_FEATURE");
setFeatureSafe(
PSSecureXMLUtils.SAX_EXTERNAL_PARAMETER_ENTITIES_FEATURE,
false,
Expand Down
Loading