[
https://issues.apache.org/jira/browse/TIKA-4938?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18120428#comment-18120428
]
Hudson commented on TIKA-4938:
------------------------------
SUCCESS: Integrated in Jenkins build Tika ยป tika-branch_3x-jdk11 #2580 (See
[https://ci-builds.apache.org/job/Tika/job/tika-branch_3x-jdk11/2580/])
TIKA-4938: convert XFAExtractor from StAX to SAX; deprecate StAX in
XMLReaderUtils (#3267) (#3269) (github:
[https://github.com/apache/tika/commit/048d87dd6bbd2e855169ce585a26f5090b8def16])
* (edit)
tika-parsers/tika-parsers-standard/tika-parsers-standard-modules/tika-parser-pdf-module/src/main/java/org/apache/tika/parser/pdf/XFAExtractor.java
* (edit) CHANGES.txt
* (add)
tika-parsers/tika-parsers-standard/tika-parsers-standard-modules/tika-parser-pdf-module/src/test/java/org/apache/tika/parser/pdf/XFAExtractorTest.java
* (edit) tika-core/src/main/java/org/apache/tika/utils/XMLReaderUtils.java
* (edit)
tika-parsers/tika-parsers-standard/tika-parsers-standard-modules/tika-parser-pdf-module/src/main/java/org/apache/tika/parser/pdf/AbstractPDF2XHTML.java
* (edit)
tika-parsers/tika-parsers-standard/tika-parsers-standard-modules/tika-parser-pdf-module/src/main/java/org/apache/tika/parser/pdf/PDFParser.java
> Migrate xfa parsing from stax to sax and cherry-pick back to 3.x
> ----------------------------------------------------------------
>
> Key: TIKA-4938
> URL: https://issues.apache.org/jira/browse/TIKA-4938
> Project: Tika
> Issue Type: Task
> Reporter: Tim Allison
> Priority: Minor
>
> CVE-2025-66516 was caused by finicky behavior in the JVM around return types
> for external entity handling in the stax parser. We found further
> differential behavior if woodstox is on the classpath (which it is in
> tika-server).
> On this ticket, I propose simplifying our parsing of xfa and our parser
> configuration and moving xfa parsing to sax. We should deprecate the stax
> handling in XMLReaderUtils and try to keep any new xml parsing to SAX or DOM
> (only if necessary).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
