From 5e0328798f36bc3df3dc9c87adb863b75bb3c952 Mon Sep 17 00:00:00 2001 From: Sebastien Tardif Date: Thu, 14 May 2026 14:40:49 -0700 Subject: [PATCH 1/2] Harden XML parsers against XXE attacks Add XXE (XML External Entity) protections to two XML parser creation sites in coherence-core that were missing them: 1. XmlSchemaSource.java: DocumentBuilderFactory.newInstance() now sets disallow-doctype-decl, external-general-entities, and external-parameter-entities features before parsing. 2. SaxParser.java: SAXParserFactory created via reflection now sets external-general-entities, external-parameter-entities, and load-external-dtd features via ClassHelper.invoke before creating the parser. Without these protections, a crafted XML input could trigger external entity resolution to read local files, make outbound network connections, or cause denial of service via entity expansion. The codebase already acknowledges this risk (ExternalizableHelper.java line 2472 comments about skipping SaxParser to prevent XXE), but the parsers themselves remained unprotected for direct callers. Closes #154 Signed-off-by: Sebastien Tardif --- .../coherence/common/schema/XmlSchemaSource.java | 7 ++++++- .../main/java/com/tangosol/run/xml/SaxParser.java | 14 ++++++++++++++ 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/prj/coherence-core/src/main/java/com/oracle/coherence/common/schema/XmlSchemaSource.java b/prj/coherence-core/src/main/java/com/oracle/coherence/common/schema/XmlSchemaSource.java index de4ba5268f9d6..431dfdea31917 100644 --- a/prj/coherence-core/src/main/java/com/oracle/coherence/common/schema/XmlSchemaSource.java +++ b/prj/coherence-core/src/main/java/com/oracle/coherence/common/schema/XmlSchemaSource.java @@ -1,5 +1,5 @@ /* - * Copyright (c) 2020 Oracle and/or its affiliates. + * Copyright (c) 2020, 2025, Oracle and/or its affiliates. * * Licensed under the Universal Permissive License v 1.0 as shown at * http://oss.oracle.com/licenses/upl. @@ -104,6 +104,11 @@ public void populateSchema(Schema schema) DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); dbf.setNamespaceAware(true); + // prevent XXE (XML External Entity) attacks + dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); + dbf.setFeature("http://xml.org/sax/features/external-general-entities", false); + dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + DocumentBuilder db = dbf.newDocumentBuilder(); Document doc = db.parse(m_inputXml); Element root = doc.getDocumentElement(); diff --git a/prj/coherence-core/src/main/java/com/tangosol/run/xml/SaxParser.java b/prj/coherence-core/src/main/java/com/tangosol/run/xml/SaxParser.java index 01c0c3a4f953a..c73aa3455fe97 100644 --- a/prj/coherence-core/src/main/java/com/tangosol/run/xml/SaxParser.java +++ b/prj/coherence-core/src/main/java/com/tangosol/run/xml/SaxParser.java @@ -535,6 +535,20 @@ protected static Parser getParser() ClassHelper.invoke(factory, "setValidating", new Object[] {Boolean.FALSE}); + // prevent XXE (XML External Entity) attacks + // factory.setFeature("http://xml.org/sax/features/external-general-entities", false); + ClassHelper.invoke(factory, + "setFeature", new Object[] { + "http://xml.org/sax/features/external-general-entities", Boolean.FALSE}); + // factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); + ClassHelper.invoke(factory, + "setFeature", new Object[] { + "http://xml.org/sax/features/external-parameter-entities", Boolean.FALSE}); + // factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); + ClassHelper.invoke(factory, + "setFeature", new Object[] { + "http://apache.org/xml/features/nonvalidating/load-external-dtd", Boolean.FALSE}); + // parser = factory.newSAXParser().getParser(); Object SAXParser = ClassHelper.invoke(factory, "newSAXParser", ClassHelper.VOID); From 7af190533cf9449c69560600d9ca7ab9c459a9f1 Mon Sep 17 00:00:00 2001 From: Sebastien Tardif Date: Thu, 14 May 2026 14:54:26 -0700 Subject: [PATCH 2/2] Trigger OCA check Signed-off-by: Sebastien Tardif