XXE vulnerability in DocumentBuilderFactory and SAXParserFactory usage

[SebTardif]

Summary

Two XML parser creation sites in coherence-core do not configure XXE (XML External Entity) protections:

1. XmlSchemaSource.java:104 -- DocumentBuilderFactory.newInstance() sets only setNamespaceAware(true) with no XXE features disabled. A crafted XML input can trigger external entity resolution.

2. SaxParser.java:529 -- SAXParserFactory is created via reflection with only setValidating(false). No XXE features are configured. The parser is cached as a static singleton and used by public parseXml() methods. The codebase is already aware of this risk (ExternalizableHelper.java:2472 comments about avoiding SaxParser to prevent XXE), but the parser itself remains unprotected for direct callers.

Impact

Both parsers can be exploited if an attacker controls the XML input:

• Read local files via file:// entity references
• Make outbound network connections via external entity URIs
• Potential denial of service via entity expansion (billion laughs attack)

Proposed Fix

Add standard XXE protections to both parsers:

• http://apache.org/xml/features/disallow-doctype-decl = true
• http://xml.org/sax/features/external-general-entities = false
• http://xml.org/sax/features/external-parameter-entities = false

Files

• prj/coherence-core/src/main/java/com/oracle/coherence/common/schema/XmlSchemaSource.java
• prj/coherence-core/src/main/java/com/tangosol/run/xml/SaxParser.java