Disable XML External Entities

[Pr0methean]

If an untrusted XML file is passed to one of the Xml class's public methods (unlikely but certainly possible), XML External Entity injection attacks are possible. This PR fixes that by disabling all known features that would cause the DocumentBuilderFactory or TransformerFactory to load external entities and doctypes. It also uses ThreadLocal::withInitial to fix failing cases of UnusedCodeTest; note that this doesn't work for InheritableThreadLocal because that class has no equivalent method.

References

• OWASP XML External Entity Prevention Cheat Sheet

Submitter checklist

• Recommended: Join WireMock Slack to get any help in #help-contributing or a project-specific channel like #wiremock-java
• The PR request is well described and justified, including the body and the references
• The PR title represents the desired changelog entry
• The repository's code style is followed (see the contributing guide)
• Test coverage that demonstrates that the change works as expected
• For new features, there's necessary documentation in this pull request or in a subsequent PR to wiremock.org

[tomakehurst]

Thanks!