Make XML parsing and validation resilient to outdated XML parsers on the classpath#894
Open
patbaumgartner wants to merge 1 commit into
Open
Conversation
…the classpath When an outdated XML parser such as Xerces 2.x leaks onto the classpath (pulled in transitively by another library), the JAXP lookup mechanism picks it up and BOM parsing/validation fails with errors like: SAXNotRecognizedException: Property 'http://javax.xml.XMLConstants/property/accessExternalDTD' is not recognized. because such parsers pre-date the JAXP 1.5 secure-processing properties. Reported against the Gradle plugin in CycloneDX/cyclonedx-gradle-plugin#349, where any plugin leaking Xerces onto the buildscript classpath breaks BOM generation. - introduce XmlFactoryUtils that prefers the JDK built-in SchemaFactory/DocumentBuilderFactory (newDefaultInstance, invoked reflectively for Java 8 compatibility) over the classpath-based JAXP lookup - use it in CycloneDxSchema, XmlParser and BomXmlGenerator - treat the ACCESS_EXTERNAL_DTD/SCHEMA hardening properties as best-effort for exotic factory implementations - add xercesImpl to the test classpath as regression coverage: before this change, all XmlParserTest cases fail with the error above Signed-off-by: Patrick Baumgartner <contact@patbaumgartner.com>
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 5 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related to CycloneDX/cyclonedx-gradle-plugin#349
Problem
When an outdated XML parser such as Xerces 2.x leaks onto the classpath (pulled in transitively by another library or Gradle plugin), the JAXP lookup mechanism (
SchemaFactory.newInstance/DocumentBuilderFactory.newInstance) picks it up, and BOM parsing/validation fails hard:These parsers pre-date the JAXP 1.5 secure-processing properties. This is what breaks
cyclonedxBomin CycloneDX/cyclonedx-gradle-plugin#349 whenever any other plugin ships Xerces on the buildscript classpath - reproducible with a plain Gradle 8.4 project, the current gradle plugin 3.3.0, andxerces:xercesImpl:2.12.2added to the buildscript classpath.Fix
XmlFactoryUtilsprefers the JDK's built-inSchemaFactory/DocumentBuilderFactoryvianewDefaultInstance(), bypassing the classpath-based JAXP lookup entirely.newDefaultInstance()only exists since Java 9 while this library targets Java 8, so it is invoked reflectively with a fallback to the standard lookupCycloneDxSchema.getXmlSchema,XmlParser.createSecureDocument,BomXmlGenerator.buildSecureDocumentBuilderACCESS_EXTERNAL_DTD/ACCESS_EXTERNAL_SCHEMAhardening properties are additionally treated as best-effort for exotic factory implementations reached through the fallback path (secure processing remains enforced, and only local schema copies are resolved)Regression coverage
xerces:xercesImpl:2.12.2is added to the test classpath. Before this change, this makes all 51XmlParserTestcases fail with the exact error above; with the change, the full suite (1614 tests) passes. This guards the library against classpath poisoning by construction.Verification
mvn clean verifygreen (1614 tests, 0 failures)xercesImplon the buildscript classpath fails withError whilst validating XML BOM/SAXNotRecognizedExceptiontoday; with this fix in core-java, validation uses the JDK parser and is unaffected