coheigea opened a new pull request, #412: URL: https://github.com/apache/cxf-xjc-utils/pull/412
When the plugin compiles an XML Schema, it was parsing that schema with external DTDs and external entities enabled. A malicious schema could abuse that — a <!DOCTYPE ... SYSTEM "file:///etc/passwd"> or an external entity — to read local files or make outbound network requests during the build (classic XXE, giving file disclosure and SSRF). The fix turns off external DTD/entity resolution during the schema parse. Real schemas don’t use DTDs, so nothing legitimate breaks, and multi-file schemas (import/include) keep working because those resolve through a different mechanism. Adds a test that fails without the fix. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
