From 1559f3a85f4279e59d242aeb9fb38c340045dd4e Mon Sep 17 00:00:00 2001 From: Jeremy Landis Date: Wed, 25 Sep 2024 20:07:33 -0400 Subject: [PATCH 1/2] Fix code scanning alert no. 6: Resolving XML external entity in user-controlled data Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- src/main/java/org/apache/ibatis/parsing/XPathParser.java | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/main/java/org/apache/ibatis/parsing/XPathParser.java b/src/main/java/org/apache/ibatis/parsing/XPathParser.java index eaff8c0dc31..35905efbb61 100644 --- a/src/main/java/org/apache/ibatis/parsing/XPathParser.java +++ b/src/main/java/org/apache/ibatis/parsing/XPathParser.java @@ -231,13 +231,16 @@ private Document createDocument(InputSource inputSource) { try { DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); + factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); + factory.setFeature("http://xml.org/sax/features/external-general-entities", false); + factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); factory.setValidating(validation); factory.setNamespaceAware(false); factory.setIgnoringComments(true); factory.setIgnoringElementContentWhitespace(false); factory.setCoalescing(false); - factory.setExpandEntityReferences(true); + factory.setExpandEntityReferences(false); DocumentBuilder builder = factory.newDocumentBuilder(); builder.setEntityResolver(entityResolver); From 650146bc7ad45c5a75ed0d59e306a9d2f5d115fe Mon Sep 17 00:00:00 2001 From: Jeremy Landis Date: Wed, 25 Sep 2024 20:12:47 -0400 Subject: [PATCH 2/2] Update XPathParser.java remove extra items, AI didn't add them on ibatis-2 so why here. Just remove to see if it works then. --- src/main/java/org/apache/ibatis/parsing/XPathParser.java | 3 --- 1 file changed, 3 deletions(-) diff --git a/src/main/java/org/apache/ibatis/parsing/XPathParser.java b/src/main/java/org/apache/ibatis/parsing/XPathParser.java index 35905efbb61..5d3fd8901e8 100644 --- a/src/main/java/org/apache/ibatis/parsing/XPathParser.java +++ b/src/main/java/org/apache/ibatis/parsing/XPathParser.java @@ -231,9 +231,6 @@ private Document createDocument(InputSource inputSource) { try { DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); - factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); - factory.setFeature("http://xml.org/sax/features/external-general-entities", false); - factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); factory.setValidating(validation); factory.setNamespaceAware(false);