DanielLeens opened a new pull request, #11250: URL: https://github.com/apache/seatunnel/pull/11250
## Summary - harden `XmlReadStrategy` so XML file parsing rejects `DOCTYPE` declarations and disables external entity / external DTD resolution - keep the XML reader hardening localized to `connector-file-base` without changing unrelated connector behavior - add an XXE regression test that asserts malicious XML payloads fail with `FILE_READ_FAILED` ## Verification - `./mvnw -pl seatunnel-connectors-v2/connector-file/connector-file-base -am spotless:apply -nsu -Dmaven.gitcommitid.skip=true -T 3C` - `./mvnw -pl seatunnel-connectors-v2/connector-file/connector-file-base -am verify -DskipTests -nsu -Dmaven.gitcommitid.skip=true -T 3C` - `cd seatunnel-connectors-v2/connector-file/connector-file-base && ../../../mvnw -Dtest=XmlReadStrategyTest#testXmlReadRejectsExternalEntityPayload -DfailIfNoTests=false -DskipIT=true -nsu -Dmaven.gitcommitid.skip=true test` ## Notes - `seatunnel-engine-ui` was not rebuilt because this change is isolated to the XML parsing path in `connector-file-base` and does not modify UI assets. - No additional end-to-end engine startup validation was repeated because this patch does not change engine startup, plugin registration, packaging, or runtime wiring; verification stayed focused on the connector module compile path and the XXE regression path. - A broader module-scoped `XmlReadStrategyTest` run reaches the target class, but the pre-existing `testXmlRead` case currently fails on `dev` with `ArrayIndexOutOfBoundsException: 14`, which is unrelated to this XXE hardening path. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
