Fix XXE vulnerability in BlazeXmlSchema - #8355
Conversation
PiperOrigin-RevId: 928558080
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request enhances XML parsing security in BlazeXmlSchema.java by configuring SAXParserFactory with secure features to prevent XML External Entity (XXE) vulnerabilities. The review feedback suggests enabling namespace awareness on the SAXParserFactory to avoid potential mapping issues with namespaced XML.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| public static TestSuite parse(InputStream input) { | ||
| try { | ||
| Object parsed = CONTEXT.createUnmarshaller().unmarshal(input); | ||
| SAXParserFactory spf = SAXParserFactory.newInstance(); |
There was a problem hiding this comment.
By default, SAXParserFactory is not namespace-aware. When unmarshalling XML using JAXB via a SAXSource, namespace awareness should be enabled to prevent potential mapping failures if the XML contains namespaces.
| SAXParserFactory spf = SAXParserFactory.newInstance(); | |
| SAXParserFactory spf = SAXParserFactory.newInstance(); | |
| spf.setNamespaceAware(true); |
github-actions
Bot
added
product: CLion
github-project-automation
Bot
moved this from Untriaged
to Done
in Bazel IntelliJ Plugin
github-actions
Bot
removed
the
awaiting-review
3 participants
PiperOrigin-RevId: 928558080
Copybara PR: #8353