Sonar violation: Disable XML external entity (XXE) processing

[romani]

https://sonarcloud.io/project/issues?id=org.checkstyle%3Acheckstyle&issues=AW9t2w41YD2QG1pPXIVJ&open=AW9t2w41YD2QG1pPXIVJ

Vulnerability at src/.../tools/checkstyle/XmlLoader.java
Disable XML external entity (XXE) processing.

All details of such rule - https://rules.sonarsource.com/java/RSPEC-2755

Reply from Security expert:

Hi Roman,
The next line setFeaturesBySystemProperty does disable the loading of external entities when the system property is not configured by the user.

checkstyle/src/main/java/com/puppycrawl/tools/checkstyle/XmlLoader.java

Lines 141 to 149 in ae9edbd

	public static void setFeaturesBySystemProperty(SAXParserFactory factory)
	throws SAXException, ParserConfigurationException {
	final boolean enableExternalDtdLoad = Boolean.parseBoolean(
	System.getProperty(ENABLE_EXTERNAL_DTD_LOAD, "false"));
	factory.setFeature(LOAD_EXTERNAL_DTD, enableExternalDtdLoad);
	factory.setFeature(EXTERNAL_GENERAL_ENTITIES, enableExternalDtdLoad);
	}

I would validate that you are using all of the prevention methods suggested in this document here:
https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
The cases you need to be concerned with are any involving the use of the SAXParserFactory.
If you find any cases you are missing, then you may be vulnerable. In which case, please let me know.
Cheers,
Jonathan Leitschuh

TODO:
We need to investigate this to make sure if we are vulnerable

[romani]

from links of Sonar description (same link provide us Jonathan), https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxb-unmarshaller

here is clear example that we do correct disablement BUT there 3 features and we use only 2.
spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false); is missed on our side.

[pbludov]

Fix is merged.

@romani can this issue be a breaking change?

[romani]

It should not, but it might, let's keep it misc

[JLLeitschuh]

Does this need a CVE assigned to it?

[romani]

I do not know how to reproduce it, so I am not sure that CVE need to be created.
If you can reproduce security, lets create CVE .

[JLLeitschuh]

Hey @romani,

I've got confirmation from someone that there is indeed a vuln here.
Can you open an advisory here: https://github.com/checkstyle/checkstyle/security/advisories

Please add myself and these two security researchers from Snyk.

• Benji @benjifin
• Leeya @leeyashalti
  (There's a third person to add but I need their GH username first)

[romani]

Can you open an advisory here

Done.
GHSA-763g-fqq7-48wg