slachiewicz commented on PR #898: URL: https://github.com/apache/maven-wagon/pull/898#issuecomment-5221968059
One more commit, closing a hole in the XXE fallback added earlier. Where `disallow-doctype-decl` is unavailable, the parser falls back to refusing external general and parameter entities — but those two calls were allowed to fail as silently as the first one. A parser supporting none of the three would have gone on to read remote input with only `FEATURE_SECURE_PROCESSING` in force, and secure processing bounds resource use; it says nothing about what a document may reach. The fallback now requires both entity features and reports a parser it cannot secure as a configuration error, rather than quietly parsing without protection. It also denies the external DTD subset via `ACCESS_EXTERNAL_DTD`, which the entity features do not govern (note `setAttribute` throws `IllegalArgumentException`, not `ParserConfigurationException`, so it needs its own catch). That branch only executes on a JAXP implementation other than the platform one, so it cannot be reached from a unit test. It was verified by configuring a factory the same way by hand: a DOCTYPE parses — as it did under Jackrabbit, which neutered entities with an `EntityResolver` rather than banning the doctype — and an external entity resolves to empty text with no file contents disclosed. On the platform parser the primary path applies and `testDoctypeIsRejected` covers it. 293 tests pass, 0 checkstyle violations. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
