Fix SchemaFactory configuration of XML validator #737

nscuro · 2025-11-02T19:52:12Z

codacy-production · 2025-11-02T19:55:52Z

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
✅ +0.08%	✅ 100.00%

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (`1d9ecdb`)	6456	4844	75.03%
Head commit (`af0ec75`)	6460 (+4)	4852 (+8)	75.11% (+0.08%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#737)	4	4	100.00%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings Change summary preferences

Copilot

Pull Request Overview

This PR adds XXE (XML External Entity) protection to prevent security vulnerabilities when parsing XML BOMs.

Added security properties to SchemaFactory to disable external DTD and schema access
Implemented a comprehensive test that validates XXE protection by attempting an actual network connection
Updated version from 11.1.0-SNAPSHOT to 11.0.1-SNAPSHOT (patch release)

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/main/java/org/cyclonedx/CycloneDxSchema.java	Added XXE protection by restricting external DTD and schema access
src/test/java/org/cyclonedx/parsers/XmlParserTest.java	Added test with server socket to verify XXE protection works correctly
src/test/resources/security/xxe-protection.xml	Updated port number to 6666 to match the test implementation
pom.xml	Changed version from 11.1.0-SNAPSHOT to 11.0.1-SNAPSHOT
README.md	Updated version reference to 11.0.1

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-11-03T09:05:00Z

src/test/java/org/cyclonedx/parsers/XmlParserTest.java

+        final AtomicBoolean receivedConnection = new AtomicBoolean(false);
+
+        final ExecutorService executor = Executors.newSingleThreadExecutor();
+        try (final ServerSocket serverSocket = new ServerSocket(6666)) {


Hardcoded port 6666 may conflict with existing services or fail in restricted environments. Consider using port 0 to let the OS assign an available ephemeral port, then retrieve it with serverSocket.getLocalPort() and update the test XML dynamically.

to prevent unintended network-block foo, we decided to go with file access the test here: https://github.com/CycloneDX/cyclonedx-javascript-library/blob/1749c7066224c9ee99c686093b6b53db4c80ca73/tests/functional/internals/OpPlug.node.xmlValidator.implementation.spec.js#L74-L90

Modified the fixture to reference a file path instead. The tests now assert on specific failure messages indicating that external resolution was blocked. Whether or not the file actually exists in then no longer relevant.

src/test/java/org/cyclonedx/parsers/XmlParserTest.java

pom.xml

jkowalleck · 2025-11-03T09:05:49Z

have a similar test in the JS lib. see
https://github.com/search?q=repo%3ACycloneDX%2Fcyclonedx-javascript-library%20vaiquia2zoo3Im8ro9zahNg5mohwipouka2xieweed6ahChei3doox2fek3ise0lmohju3loh5oDu7eigh3jaeR2aiph2Voo&type=code

jkowalleck · 2025-11-03T09:37:08Z

src/main/java/org/cyclonedx/CycloneDxSchema.java


  public Schema getXmlSchema(InputStream... inputStreams) throws SAXException {
    final SchemaFactory schemaFactory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
+    schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");


does this actually prevent XEE? or does it only prevent unintended network access?

what about XMLConstants.FEATURE_SECURE_PROCESSING ?
what about schemaFactory.setExpandEntityReferences(false);?
or similar?

schemaFactory.setExpandEntityReferences doesn't exist.

The ACCESS_EXTERNAL_* values are a list of protocols which are allowed, setting it to empty makes it disallow all:

https://docs.oracle.com/javase/8/docs/api/javax/xml/XMLConstants.html#ACCESS_EXTERNAL_SCHEMA

https://docs.oracle.com/javase/8/docs/api/javax/xml/XMLConstants.html#ACCESS_EXTERNAL_DTD

I verified that this also prevents file:// access.

I will add FEATURE_SECURE_PROCESSING though, thanks for the tip.

Signed-off-by: nscuro <[email protected]>

Copilot

Pull Request Overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

README.md

nscuro · 2025-11-06T11:24:27Z

@jkowalleck May I ask for a final look please?

jkowalleck · 2025-11-06T11:37:49Z

LGTM, but I am no actual Java user.
Will formally approve to prevent any blockers.

If further review is needed, let me ping some potential reviewers: @DarthHater, @stevespringett, @mr-zepol, @mtsfoni, @hboutemy, @skhokhlov, @glefloch,

nscuro added the bug Something isn't working label Nov 2, 2025

nscuro requested a review from a team as a code owner November 2, 2025 19:52

nscuro force-pushed the fix-schemafactory-config branch from 66161f8 to 658183c Compare November 2, 2025 19:54

jkowalleck requested a review from Copilot November 3, 2025 09:01

Copilot AI reviewed Nov 3, 2025

View reviewed changes

nscuro force-pushed the fix-schemafactory-config branch from 658183c to 4a0121c Compare November 3, 2025 09:27

jkowalleck reviewed Nov 3, 2025

View reviewed changes

Fix SchemaFactory configuration of XML validator

af0ec75

Signed-off-by: nscuro <[email protected]>

nscuro force-pushed the fix-schemafactory-config branch from 4a0121c to af0ec75 Compare November 3, 2025 10:13

nscuro requested review from Copilot and jkowalleck November 3, 2025 10:15

Copilot AI reviewed Nov 3, 2025

View reviewed changes

README.md Show resolved Hide resolved

jkowalleck approved these changes Nov 6, 2025

View reviewed changes

nscuro merged commit 731b802 into CycloneDX:master Nov 10, 2025
15 checks passed

mend-bolt-for-github bot mentioned this pull request Nov 11, 2025

cyclonedx-core-java-9.0.2.jar: 2 vulnerabilities (highest severity is: 7.5) ktapdiya/wrongsecrets#10

Open

This was referenced Nov 11, 2025

cyclonedx-core-java-9.0.0.jar: 2 vulnerabilities (highest severity is: 7.5) jgeraigery/Citi-dependency-track#8

Open

cyclonedx-core-java-7.3.0.jar: 2 vulnerabilities (highest severity is: 7.5) snowdensb/dependency-track#61

Open

Uh oh!

Fix SchemaFactory configuration of XML validator #737

Fix SchemaFactory configuration of XML validator #737

Conversation

nscuro commented Nov 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codacy-production bot commented Nov 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage summary from Codacy

See diff coverage on Codacy

See your quality gate settings Change summary preferences

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Nov 3, 2025

Choose a reason for hiding this comment

Uh oh!

jkowalleck Nov 3, 2025

Choose a reason for hiding this comment

Uh oh!

nscuro Nov 3, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

jkowalleck commented Nov 3, 2025

Uh oh!

jkowalleck Nov 3, 2025

Choose a reason for hiding this comment

Uh oh!

nscuro Nov 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

nscuro commented Nov 6, 2025

Uh oh!

jkowalleck commented Nov 6, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

nscuro commented Nov 2, 2025 •

edited

Loading

codacy-production bot commented Nov 2, 2025 •

edited

Loading