This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-vfs.git
The following commit(s) were added to refs/heads/master by this push:
new 7eb758849 Harden XML parsing via commons-secure-xml (#781)
7eb758849 is described below
commit 7eb7588496904a5dd182cdf51f8bee8977d5ba19
Author: Piotr P. Karwasz <[email protected]>
AuthorDate: Sun Sep 6 14:55:23 2026 +0200
Harden XML parsing via commons-secure-xml (#781)
* Harden XML parsing via commons-secure-xml
Create the document builder that parses providers.xml configuration
files through org.apache.commons:commons-secure-xml. The secure factory
enables FEATURE_SECURE_PROCESSING and installs a non-removable
entity-resolver floor on every parser it produces: external DTD and
entity lookups are resolved to empty content instead of being fetched,
and internal entity expansion is bounded, regardless of the JAXP
implementation on the classpath.
Changes:
- Add the commons-secure-xml dependency (1.0.0-SNAPSHOT until its first
release) to commons-vfs2.
- Route factory creation through SecureDocumentBuilderFactory in
StandardFileSystemManager. Internal entities declared in a
configuration file's own DTD subset still expand
(setExpandEntityReferences stays on); only external content is
affected.
- Run the CI and CodeQL builds with -Puse-apache-snapshots (inherited
from the org.apache:apache parent POM) so the commons-secure-xml
SNAPSHOT resolves; CodeQL's autobuild receives the profile through
MAVEN_ARGS.
Assisted-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MHgnMnGWHQoH2zD2jFdoMT
* Use the Commons Secure XML 1.0.0 release candidate
Bump org.apache.commons:commons-secure-xml from 1.0.0-SNAPSHOT to 1.0.0
and add the temporary staging repository
https://repository.apache.org/content/repositories/orgapachecommons-1962/
after Central, so the vote gets downstream CI results. Drop the
-Puse-apache-snapshots profile from the CI workflows, which the release
version no longer needs. Remove the staging repository once 1.0.0 is
released.
Assisted-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_0167e29ScPEdfzJnEFm95imK
* Bump Apache Commons Secure XML from 1.0.0-SNAPSHOT to 1.0.0
---------
Co-authored-by: Gary Gregory <[email protected]>
---
commons-vfs2/pom.xml | 4 ++++
.../org/apache/commons/vfs2/impl/StandardFileSystemManager.java | 3 ++-
pom.xml | 7 ++++++-
src/changes/changes.xml | 1 +
4 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/commons-vfs2/pom.xml b/commons-vfs2/pom.xml
index 29ffffeca..f077475da 100644
--- a/commons-vfs2/pom.xml
+++ b/commons-vfs2/pom.xml
@@ -31,6 +31,10 @@
<relativePath>../pom.xml</relativePath>
</parent>
<dependencies>
+ <dependency>
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-secure-xml</artifactId>
+ </dependency>
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
diff --git
a/commons-vfs2/src/main/java/org/apache/commons/vfs2/impl/StandardFileSystemManager.java
b/commons-vfs2/src/main/java/org/apache/commons/vfs2/impl/StandardFileSystemManager.java
index 853cbedb0..eb4c8cf14 100644
---
a/commons-vfs2/src/main/java/org/apache/commons/vfs2/impl/StandardFileSystemManager.java
+++
b/commons-vfs2/src/main/java/org/apache/commons/vfs2/impl/StandardFileSystemManager.java
@@ -36,6 +36,7 @@ import org.apache.commons.vfs2.VfsLog;
import org.apache.commons.vfs2.operations.FileOperationProvider;
import org.apache.commons.vfs2.provider.FileProvider;
import org.apache.commons.vfs2.util.Messages;
+import org.apache.commons.xml.secure.SecureDocumentBuilderFactory;
import org.w3c.dom.Element;
import org.w3c.dom.NodeList;
@@ -249,7 +250,7 @@ public class StandardFileSystemManager extends
DefaultFileSystemManager {
* @throws ParserConfigurationException if an error occurs.
*/
private DocumentBuilder createDocumentBuilder() throws
ParserConfigurationException {
- final DocumentBuilderFactory factory =
DocumentBuilderFactory.newInstance();
+ final DocumentBuilderFactory factory =
SecureDocumentBuilderFactory.newInstance();
factory.setIgnoringElementContentWhitespace(true);
factory.setIgnoringComments(true);
factory.setExpandEntityReferences(true);
diff --git a/pom.xml b/pom.xml
index 4df2d2ecc..dfcf515d6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -359,7 +359,12 @@
<artifactId>commons-vfs2-examples</artifactId>
<version>${project.version}</version>
</dependency>
- <!-- 3rd party dependencies -->
+ <!-- dependencies -->
+ <dependency>
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-secure-xml</artifactId>
+ <version>1.0.0</version>
+ </dependency>
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index 08a1777df..93ac9fa6b 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -47,6 +47,7 @@ The <action> type attribute can be add,update,fix,remove.
<body>
<release version="2.11.0" date="YYYY-MM-DD" description="This is a feature
and maintenance release. Java 8 or later is required.">
<!-- FIX -->
+ <action type="fix" dev="pkarwasz" due-to="Piotr P. Karwasz, Gary
Gregory">Parse providers.xml configuration files through
org.apache.commons:commons-secure-xml, so external entities and DTDs are no
longer fetched by default.</action>
<action type="fix" dev="ggregory" due-to="Gary Gregory">Rework
FTPClientWrapper.disconnect() to remove any chance of a new connection being
created on demand.</action>
<action type="fix" dev="ggregory" due-to="Gary Gregory">The write buffer
size in DefaultFileContent is now 8K instead of 4K.</action>
<action type="fix" dev="ggregory" due-to="Anthony Goubard">Improve
performance of encoding URIs #660.</action>
