mattcasters opened a new issue, #8163: URL: https://github.com/apache/hop/issues/8163
### What needs to happen? `XmlInputStream` creates a raw StAX `XMLInputFactory` and does not disable DTD processing or external entity resolution: https://github.com/apache/hop/blob/main/plugins/transforms/xml/src/main/java/org/apache/hop/pipeline/transforms/xml/xmlinputstream/XmlInputStream.java Other Hop XML parsers already go through `XmlParserFactoryProducer` (DOM / SAX / Schema) or set `XMLInputFactory.SUPPORT_DTD=false` and `IS_SUPPORTING_EXTERNAL_ENTITIES=false` locally (Excel `StaxUtil`, `AdvancedXmlOutput`). XML Input Stream (StAX) should do the same. Add `XmlParserFactoryProducer.createSecureXmlInputFactory()` and use it from `XmlInputStream` (and the other remaining raw/partial StAX factory sites). **Behavior change:** XML documents that contain a DOCTYPE will fail to parse. That is the intended trade-off. Internal/external entity expansion during StAX ingest is not a supported feature of this transform. ### Issue Priority Priority: 1 ### Issue Component Component: Transforms, API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
