Skip to content

Refactor XML parsing to use safer document builders in multiple classes #12129

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: 4.20
Choose a base branch
from
+16 −14
Open

Refactor XML parsing to use safer document builders in multiple classes #12129

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions ...in/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtMigrateVolumeCommandWrapper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@
import org.apache.cloudstack.storage.datastore.util.ScaleIOUtil;
import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
import org.apache.cloudstack.storage.to.VolumeObjectTO;
import org.apache.cloudstack.utils.security.ParserUtils;
import org.apache.commons.lang3.ArrayUtils;
import org.apache.commons.lang3.StringUtils;
import org.libvirt.Connect;
Expand Down Expand Up @@ -216,7 +217,7 @@ protected MigrateVolumeAnswer checkBlockJobStatus(MigrateVolumeCommand command,

private String generateDestinationDiskLabel(String diskXml) throws ParserConfigurationException, IOException, SAXException {

DocumentBuilderFactory dbFactory = DocumentBuilderFactory.newInstance();
DocumentBuilderFactory dbFactory = ParserUtils.getSaferDocumentBuilderFactory();
DocumentBuilder dBuilder = dbFactory.newDocumentBuilder();
Document doc = dBuilder.parse(new ByteArrayInputStream(diskXml.getBytes("UTF-8")));
doc.getDocumentElement().normalize();
Expand All @@ -230,7 +231,7 @@ private String generateDestinationDiskLabel(String diskXml) throws ParserConfigu
protected String generateDestinationDiskXML(Domain dm, String srcVolumeId, String diskFilePath, String destSecretUUID) throws LibvirtException, ParserConfigurationException, IOException, TransformerException, SAXException {
final String domXml = dm.getXMLDesc(0);

DocumentBuilderFactory dbFactory = DocumentBuilderFactory.newInstance();
DocumentBuilderFactory dbFactory = ParserUtils.getSaferDocumentBuilderFactory();
DocumentBuilder dBuilder = dbFactory.newDocumentBuilder();
Document doc = dBuilder.parse(new ByteArrayInputStream(domXml.getBytes("UTF-8")));
doc.getDocumentElement().normalize();
Expand Down
2 changes: 1 addition & 1 deletion server/src/main/java/com/cloud/test/DatabaseConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -429,7 +429,7 @@ protected void doConfig() {
try {
final File configFile = new File(_configFileName);

SAXParserFactory spfactory = SAXParserFactory.newInstance();
SAXParserFactory spfactory = ParserUtils.getSaferSAXParserFactory();
final SAXParser saxParser = spfactory.newSAXParser();
final DbConfigXMLHandler handler = new DbConfigXMLHandler();
handler.setParent(this);
Expand Down
23 changes: 12 additions & 11 deletions utils/src/main/java/com/cloud/utils/cisco/n1kv/vsm/VsmCommand.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@
import javax.xml.parsers.ParserConfigurationException;

import org.apache.logging.log4j.Logger;
import org.apache.cloudstack.utils.security.ParserUtils;
import org.apache.logging.log4j.LogManager;
Comment on lines +29 to 30
Copy link

Copilot AI Nov 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The import for ParserUtils is placed between two org.apache.logging.log4j imports, breaking the proper import ordering. Imports should be grouped and sorted alphabetically within their groups. The ParserUtils import should be placed after LogManager import to maintain proper ordering of org.apache.cloudstack and org.apache.logging imports.

Suggested change
import org.apache.cloudstack.utils.security.ParserUtils;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.LogManager;
import org.apache.cloudstack.utils.security.ParserUtils;

Copilot uses AI. Check for mistakes.
import org.w3c.dom.DOMException;
import org.w3c.dom.DOMImplementation;
Expand Down Expand Up @@ -67,7 +68,7 @@ public enum OperationType {
public static String getAddPortProfile(String name, PortProfileType type, BindingType binding, SwitchPortMode mode, int vlanid, String vdc, String espName) {
try {
// Create the document and root element.
DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
DocumentBuilderFactory docFactory = ParserUtils.getSaferDocumentBuilderFactory();
DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
DOMImplementation domImpl = docBuilder.getDOMImplementation();
Document doc = createDocument(domImpl);
Expand Down Expand Up @@ -100,7 +101,7 @@ public static String getAddPortProfile(String name, PortProfileType type, Bindin
public static String getAddPortProfile(String name, PortProfileType type, BindingType binding, SwitchPortMode mode, int vlanid) {
try {
// Create the document and root element.
DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
DocumentBuilderFactory docFactory = ParserUtils.getSaferDocumentBuilderFactory();
DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
DOMImplementation domImpl = docBuilder.getDOMImplementation();
Document doc = createDocument(domImpl);
Expand Down Expand Up @@ -133,7 +134,7 @@ public static String getAddPortProfile(String name, PortProfileType type, Bindin
public static String getUpdatePortProfile(String name, SwitchPortMode mode, List<Pair<VsmCommand.OperationType, String>> params) {
try {
// Create the document and root element.
DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
DocumentBuilderFactory docFactory = ParserUtils.getSaferDocumentBuilderFactory();
DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
DOMImplementation domImpl = docBuilder.getDOMImplementation();
Document doc = createDocument(domImpl);
Expand Down Expand Up @@ -166,7 +167,7 @@ public static String getUpdatePortProfile(String name, SwitchPortMode mode, List
public static String getDeletePortProfile(String portName) {
try {
// Create the document and root element.
DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
DocumentBuilderFactory docFactory = ParserUtils.getSaferDocumentBuilderFactory();
DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
DOMImplementation domImpl = docBuilder.getDOMImplementation();
Document doc = createDocument(domImpl);
Expand Down Expand Up @@ -199,7 +200,7 @@ public static String getDeletePortProfile(String portName) {
public static String getAddPolicyMap(String name, int averageRate, int maxRate, int burstRate) {
try {
// Create the document and root element.
DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
DocumentBuilderFactory docFactory = ParserUtils.getSaferDocumentBuilderFactory();
DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
DOMImplementation domImpl = docBuilder.getDOMImplementation();
Document doc = createDocument(domImpl);
Expand Down Expand Up @@ -232,7 +233,7 @@ public static String getAddPolicyMap(String name, int averageRate, int maxRate,
public static String getDeletePolicyMap(String name) {
try {
// Create the document and root element.
DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
DocumentBuilderFactory docFactory = ParserUtils.getSaferDocumentBuilderFactory();
DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
DOMImplementation domImpl = docBuilder.getDOMImplementation();
Document doc = createDocument(domImpl);
Expand Down Expand Up @@ -265,7 +266,7 @@ public static String getDeletePolicyMap(String name) {
public static String getServicePolicy(String policyMap, String portProfile, boolean attach) {
try {
// Create the document and root element.
DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
DocumentBuilderFactory docFactory = ParserUtils.getSaferDocumentBuilderFactory();
DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
DOMImplementation domImpl = docBuilder.getDOMImplementation();
Document doc = createDocument(domImpl);
Expand Down Expand Up @@ -297,7 +298,7 @@ public static String getServicePolicy(String policyMap, String portProfile, bool

public static String getPortProfile(String name) {
try {
DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
DocumentBuilderFactory docFactory = ParserUtils.getSaferDocumentBuilderFactory();
DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
DOMImplementation domImpl = docBuilder.getDOMImplementation();
Document doc = createDocument(domImpl);
Expand Down Expand Up @@ -334,7 +335,7 @@ public static String getPortProfile(String name) {

public static String getPolicyMap(String name) {
try {
DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
DocumentBuilderFactory docFactory = ParserUtils.getSaferDocumentBuilderFactory();
DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
DOMImplementation domImpl = docBuilder.getDOMImplementation();
Document doc = createDocument(domImpl);
Expand Down Expand Up @@ -367,7 +368,7 @@ public static String getPolicyMap(String name) {

public static String getHello() {
try {
DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
DocumentBuilderFactory docFactory = ParserUtils.getSaferDocumentBuilderFactory();
DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
DOMImplementation domImpl = docBuilder.getDOMImplementation();

Expand Down Expand Up @@ -395,7 +396,7 @@ public static String getHello() {
public static String getVServiceNode(String vlanId, String ipAddr) {
try {
// Create the document and root element.
DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
DocumentBuilderFactory docFactory = ParserUtils.getSaferDocumentBuilderFactory();
DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
DOMImplementation domImpl = docBuilder.getDOMImplementation();
Document doc = createDocument(domImpl);
Expand Down
Loading