jamesfredley opened a new pull request, #16310: URL: https://github.com/apache/grails-core/pull/16310
## Summary ASF security review finding **f002**: SAX XXE hardening in `SpringIOUtils.createParserFactory` set parser features with `https://xml.org/...` and `https://apache.org/...`. The registered JAXP / Xerces identifiers are the `http://` forms, so the factory rejected the features and the empty catch hid the failure. `XmlDataBindingSourceCreator` still uses `SpringIOUtils.createXmlSlurper()` for `application/xml` request bodies. The HTTP test-client `XmlUtils` had the same identifiers and left `disallow-doctype-decl` false. This is hardening, not a HIGH CVE against the current threat model (THREAT_MODEL.md ยง9 disclaims parser configuration / XXE). No threat-model change in this PR. ## Changes - Use the registered `http://xml.org/...` and `http://apache.org/...` SAX feature URIs. - Set `disallow-doctype-decl` to `true` and disable XInclude. - Apply the same defaults in the HTTP test-client XML slurper. - Cover DOCTYPE rejection in `SpringIOUtilsSpec`, `XmlUtilsSpec`, and `TestHttpResponseSpec`. ## Testing - `:grails-gradle:grails-gradle-model:test` - `:grails-testing-support-http-client:test` - `:grails-gradle:grails-gradle-model:codeStyle` - `:grails-testing-support-http-client:codeStyle` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
