ABFS: disable external entity resolution when parsing Blob endpoint XML

[nishat-06]

Description of PR

Blob endpoint XML responses are parsed with external entities enabled

parseBlockListResponse creates its DocumentBuilderFactory via newInstance(), and the saxParserThreadLocal behind parseListPathResults and parseListContainersResponse does the same with SAXParserFactory. Neither disables DOCTYPE or external entity resolution, so XML coming back from the Blob endpoint on GetBlockList, ListBlobs and ListContainers is parsed with entity resolution on, and a response carrying <!ENTITY xxe SYSTEM "file:///..."> has the entity resolved client side, with the contents landing in block ids and listing entries. Both now use the secure factories hadoop-common already exposes in XMLUtils for exactly this.

I do not have a JIRA id for this yet, so the title does not carry one. Happy to file one and rename if you would like it tracked that way.

How was this patch tested?

New unit test TestAbfsBlobClientXmlParsing under hadoop-azure. It feeds parseBlockListResponse a block list response whose block name is an external entity pointing at a temp file: before the change the parse succeeds and hands back the file contents as a block id, after it the parse raises IOException. A second case parses a well formed block list and checks the ids still come through, so valid responses are unaffected.

Ran locally on JDK 11:

• mvn test -pl hadoop-tools/hadoop-azure -Dtest='TestAbfsBlobClientXmlParsing,TestBlobListXmlParser,TestListActionTaker,TestAbfsClient,TestAbfsHttpOperation' — 11 tests, all pass
• mvn install -DskipTests from the root — BUILD SUCCESS
• mvn checkstyle:check -pl hadoop-tools/hadoop-azure — nothing new on the two touched files

The ABFS ITest suites need a live storage account, which I do not have, so they have not been run. That is the one gap I would ask a reviewer with an endpoint to cover.

For code changes:

• Does the title or this PR starts with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')?
• Object storage: have the integration tests been executed and the endpoint declared according to the connector-specific documentation?
• If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?
• If applicable, have you updated the LICENSE, LICENSE-binary, NOTICE-binary files?

No new dependencies; XMLUtils is already reachable from hadoop-azure through the hadoop-common provided dependency.

AI Tooling

If an AI tool was used:

• The PR includes the phrase "Contains content generated by "
  where is the name of the AI tool used.
• My use of AI contributions follows the ASF legal policy
  https://www.apache.org/legal/generative-tooling.html

Contains content generated by Claude Code.

[hadoop-yetus]

🎊 +1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 21s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 0s		codespell was not available.
+0 🆗	detsecrets	0m 0s		detect-secrets was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
+1 💚	test4tests	0m 0s		The patch appears to include 1 new or modified test files.
			_ trunk Compile Tests _
+1 💚	mvninstall	27m 16s		trunk passed
+1 💚	compile	0m 35s		trunk passed with JDK Ubuntu-21.0.11+10-1-24.04.2-Ubuntu
+1 💚	compile	0m 39s		trunk passed with JDK Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
+1 💚	checkstyle	0m 33s		trunk passed
+1 💚	mvnsite	0m 41s		trunk passed
+1 💚	javadoc	0m 32s		trunk passed with JDK Ubuntu-21.0.11+10-1-24.04.2-Ubuntu
+1 💚	javadoc	0m 30s		trunk passed with JDK Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
+1 💚	spotbugs	0m 52s		trunk passed
+1 💚	shadedclient	17m 17s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+1 💚	mvninstall	0m 22s		the patch passed
+1 💚	compile	0m 20s		the patch passed with JDK Ubuntu-21.0.11+10-1-24.04.2-Ubuntu
+1 💚	javac	0m 20s		the patch passed
+1 💚	compile	0m 22s		the patch passed with JDK Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
+1 💚	javac	0m 22s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	checkstyle	0m 17s		the patch passed
+1 💚	mvnsite	0m 23s		the patch passed
+1 💚	javadoc	0m 17s		the patch passed with JDK Ubuntu-21.0.11+10-1-24.04.2-Ubuntu
+1 💚	javadoc	0m 17s		the patch passed with JDK Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
+1 💚	spotbugs	0m 49s		the patch passed
+1 💚	shadedclient	17m 59s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
+1 💚	unit	1m 45s		hadoop-azure in the patch passed.
+1 💚	asflicense	0m 21s		The patch does not generate ASF License warnings.
		73m 56s

Subsystem	Report/Notes
Docker	ClientAPI=1.55 ServerAPI=1.55 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8609/1/artifact/out/Dockerfile
GITHUB PR	#8609
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient spotbugs checkstyle codespell detsecrets
uname	Linux 3b14f1a900e2 5.15.0-179-generic #189-Ubuntu SMP Tue May 5 18:20:56 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / a205ea5
Default Java	Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
Multi-JDK versions	/usr/lib/jvm/java-21-openjdk-amd64:Ubuntu-21.0.11+10-1-24.04.2-Ubuntu /usr/lib/jvm/java-17-openjdk-amd64:Ubuntu-17.0.19+10-1-24.04.2-Ubuntu
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8609/1/testReport/
Max. process+thread count	632 (vs. ulimit of 10000)
modules	C: hadoop-tools/hadoop-azure U: hadoop-tools/hadoop-azure
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8609/1/console
versions	git=2.43.0 maven=3.9.15 spotbugs=4.9.7
Powered by	Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.