This is an automated email from the ASF dual-hosted git repository. ppkarwasz pushed a commit to branch feat/use-commons-xml in repository https://gitbox.apache.org/repos/asf/commons-vfs.git
commit e93dbcbf4c861f114c4a1af5770073b511cdf4df Author: Piotr P. Karwasz <[email protected]> AuthorDate: Mon Aug 31 15:35:53 2026 +0200 Harden XML parsing via commons-secure-xml Create the document builder that parses providers.xml configuration files through org.apache.commons:commons-secure-xml. The secure factory enables FEATURE_SECURE_PROCESSING and installs a non-removable entity-resolver floor on every parser it produces: external DTD and entity lookups are resolved to empty content instead of being fetched, and internal entity expansion is bounded, regardless of the JAXP implementation on the classpath. Changes: - Add the commons-secure-xml dependency (1.0.0-SNAPSHOT until its first release) to commons-vfs2. - Route factory creation through SecureDocumentBuilderFactory in StandardFileSystemManager. Internal entities declared in a configuration file's own DTD subset still expand (setExpandEntityReferences stays on); only external content is affected. - Run the CI and CodeQL builds with -Puse-apache-snapshots (inherited from the org.apache:apache parent POM) so the commons-secure-xml SNAPSHOT resolves; CodeQL's autobuild receives the profile through MAVEN_ARGS. Assisted-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01MHgnMnGWHQoH2zD2jFdoMT --- .github/workflows/codeql-analysis.yml | 2 ++ .github/workflows/maven.yml | 2 +- commons-vfs2/pom.xml | 5 +++++ .../java/org/apache/commons/vfs2/impl/StandardFileSystemManager.java | 3 ++- src/changes/changes.xml | 1 + 5 files changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 38e64244a..8874b24b0 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -70,6 +70,8 @@ jobs: # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # 4.37.6 + env: + MAVEN_ARGS: -Puse-apache-snapshots # âšī¸ Command-line programs to run using the OS shell. # đ https://git.io/JvXDl diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml index 5166df368..14f29a8f7 100644 --- a/.github/workflows/maven.yml +++ b/.github/workflows/maven.yml @@ -64,4 +64,4 @@ jobs: distribution: ${{ runner.os == 'macOS' && matrix.java == '8' && 'zulu' || 'temurin' }} java-version: ${{ matrix.java }} - name: Build with Maven - run: mvn --errors --show-version --batch-mode --no-transfer-progress -DtrimStackTrace=false '-Djdk.tls.client.protocols=TLSv1.2' + run: mvn --errors --show-version --batch-mode --no-transfer-progress -DtrimStackTrace=false '-Djdk.tls.client.protocols=TLSv1.2' -Puse-apache-snapshots diff --git a/commons-vfs2/pom.xml b/commons-vfs2/pom.xml index 29ffffeca..abe935ede 100644 --- a/commons-vfs2/pom.xml +++ b/commons-vfs2/pom.xml @@ -31,6 +31,11 @@ <relativePath>../pom.xml</relativePath> </parent> <dependencies> + <dependency> + <groupId>org.apache.commons</groupId> + <artifactId>commons-secure-xml</artifactId> + <version>1.0.0-SNAPSHOT</version> + </dependency> <dependency> <groupId>commons-logging</groupId> <artifactId>commons-logging</artifactId> diff --git a/commons-vfs2/src/main/java/org/apache/commons/vfs2/impl/StandardFileSystemManager.java b/commons-vfs2/src/main/java/org/apache/commons/vfs2/impl/StandardFileSystemManager.java index 853cbedb0..eb4c8cf14 100644 --- a/commons-vfs2/src/main/java/org/apache/commons/vfs2/impl/StandardFileSystemManager.java +++ b/commons-vfs2/src/main/java/org/apache/commons/vfs2/impl/StandardFileSystemManager.java @@ -36,6 +36,7 @@ import org.apache.commons.vfs2.VfsLog; import org.apache.commons.vfs2.operations.FileOperationProvider; import org.apache.commons.vfs2.provider.FileProvider; import org.apache.commons.vfs2.util.Messages; +import org.apache.commons.xml.secure.SecureDocumentBuilderFactory; import org.w3c.dom.Element; import org.w3c.dom.NodeList; @@ -249,7 +250,7 @@ public class StandardFileSystemManager extends DefaultFileSystemManager { * @throws ParserConfigurationException if an error occurs. */ private DocumentBuilder createDocumentBuilder() throws ParserConfigurationException { - final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); + final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); factory.setIgnoringElementContentWhitespace(true); factory.setIgnoringComments(true); factory.setExpandEntityReferences(true); diff --git a/src/changes/changes.xml b/src/changes/changes.xml index 4b1af0f0b..216499080 100644 --- a/src/changes/changes.xml +++ b/src/changes/changes.xml @@ -47,6 +47,7 @@ The <action> type attribute can be add,update,fix,remove. <body> <release version="2.11.0" date="YYYY-MM-DD" description="This is a feature and maintenance release. Java 8 or later is required."> <!-- FIX --> + <action type="fix" dev="pkarwasz">Parse providers.xml configuration files through org.apache.commons:commons-secure-xml, so external entities and DTDs are no longer fetched by default.</action> <action type="fix" dev="ggregory" due-to="Gary Gregory">Rework FTPClientWrapper.disconnect() to remove any chance of a new connection being created on demand.</action> <action type="fix" dev="ggregory" due-to="Gary Gregory">The write buffer size in DefaultFileContent is now 8K instead of 4K.</action> <action type="fix" dev="ggregory" due-to="Anthony Goubard">Improve performance of encoding URIs #660.</action>
