fix(QTDI-1938): Resolving XML external entity in user-controlled data

[yyin-talend]

Potential fix for https://github.com/Talend/component-runtime/security/code-scanning/30

To fix this XXE vulnerability, ensure that the JAXB Unmarshaller is configured to disallow external entity expansion and DTD parsing. The standard mitigation is to set a custom XMLInputFactory/SAXParserFactory or to use a javax.xml.stream.XMLStreamReader or javax.xml.parsers.SAXParser with features that disable DTDs and external entities, then pass the result to the JAXB Unmarshaller. The most portable and concise approach (recommended by OWASP and Oracle) is to use a hardened SAXSource, i.e., create a SAXParserFactory, disable external entities, and create an XMLReader for the parsing.

The concrete change is:
Replace the call to

.unmarshal(new StreamSource(new ByteArrayInputStream(value)), key)

with

.unmarshal(new SAXSource(xmlReader, new InputSource(new ByteArrayInputStream(value))), key)

where xmlReader is an XMLReader from a SAXParserFactory with DTD and external entity handling disabled. This requires importing org.xml.sax.InputSource, javax.xml.parsers.SAXParserFactory, and org.xml.sax.XMLReader. Only modify JAXBDecoder.java as shown; do not alter how JAXBContext is managed.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[sonar-eks]

Quality Gate passed

Issues

• 0 New Issues
• 1 Fixed Issue
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• 100.00% Coverage (66.50% Estimated after merge)
• 0.00% Duplicated Code (1.40% Estimated after merge)

Project ID: org.talend.sdk.component:component-runtime

View in SonarQube

[undx]

lgtm