FasterXML/woodstox

Add support for `XMLConstants.FEATURE_SECURE_PROCESSING` via SAX/Stax factories

Closed this issue · 4 comments

cowtowncoder commented

note: behavior clarified in JEP=185). Also related: #51

So: to support more standard JAXP/Staax configuration, let's add support for "secure processing" configurability. This will be in addition to Woodstox-specific (and more convenient, but only if using Woodstox) configuration options... although looks like there was no "configureForSecurity()` yet, so we might as well add that as an alias.

cowtowncoder commented

Added skeletal support for both Stax and SAX factories: enabling via setProperty/setFeature (Stax / SAX) will disable resolution of external parsed entities, which seems like the only obvious setting.
Since Woodstox already sets reasonably size limits, did not add stricter settings although if someone suggests better settings I am open to further changes.

Note that I did not add support for either system property or jaxp.properties -- if those are desired, please file a separate issue.

cowtowncoder commented

Will be included in 5.3.0 to be released today.

deanshapira commented

@cowtowncoder is there a CVE associated with this security vulnerability?

cowtowncoder commented

@deanshapira Not that I know of. Since it simply bundles enabling of existing settings I don't think it would qualify.