[
https://issues.apache.org/jira/browse/TIKA-4938?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18120281#comment-18120281
]
Hudson commented on TIKA-4938:
------------------------------
SUCCESS: Integrated in Jenkins build Tika ยป tika-main-jdk17 #1683 (See
[https://ci-builds.apache.org/job/Tika/job/tika-main-jdk17/1683/])
TIKA-4938: convert XFAExtractor from StAX to SAX; deprecate StAX in
XMLReaderUtils (#3267) (github:
[https://github.com/apache/tika/commit/df85810303bdd51e4a7f5accbcfb0d659b922631])
* (add)
tika-parsers/tika-parsers-standard/tika-parsers-standard-modules/tika-parser-pdf-module/src/test/java/org/apache/tika/parser/pdf/XFAExtractorTest.java
* (edit) tika-core/src/main/java/org/apache/tika/utils/XMLReaderUtils.java
* (edit)
tika-parsers/tika-parsers-standard/tika-parsers-standard-modules/tika-parser-pdf-module/src/main/java/org/apache/tika/parser/pdf/XFAExtractor.java
* (edit)
tika-parsers/tika-parsers-standard/tika-parsers-standard-modules/tika-parser-pdf-module/src/main/java/org/apache/tika/parser/pdf/AbstractPDF2XHTML.java
* (edit) CHANGES.txt
* (edit)
tika-parsers/tika-parsers-standard/tika-parsers-standard-modules/tika-parser-pdf-module/src/main/java/org/apache/tika/parser/pdf/PDFParser.java
> Migrate xfa parsing from stax to sax and cherry-pick back to 3.x
> ----------------------------------------------------------------
>
> Key: TIKA-4938
> URL: https://issues.apache.org/jira/browse/TIKA-4938
> Project: Tika
> Issue Type: Task
> Reporter: Tim Allison
> Priority: Minor
>
> CVE-2025-66516 was caused by finicky behavior in the JVM around return types
> for external entity handling in the stax parser. We found further
> differential behavior if woodstox is on the classpath (which it is in
> tika-server).
> On this ticket, I propose simplifying our parsing of xfa and our parser
> configuration and moving xfa parsing to sax. We should deprecate the stax
> handling in XMLReaderUtils and try to keep any new xml parsing to SAX or DOM
> (only if necessary).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
