From 50f1f9b07059fc1ad91fddb060b5045f35edaf14 Mon Sep 17 00:00:00 2001 From: labkey-jeckels Date: Wed, 22 Jul 2026 15:53:33 -0700 Subject: [PATCH] Use centrally configured SchemaFactory --- .../targetedms/parser/skyaudit/SkylineAuditLogParser.java | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/org/labkey/targetedms/parser/skyaudit/SkylineAuditLogParser.java b/src/org/labkey/targetedms/parser/skyaudit/SkylineAuditLogParser.java index 0c38c0784..a8902e8e9 100644 --- a/src/org/labkey/targetedms/parser/skyaudit/SkylineAuditLogParser.java +++ b/src/org/labkey/targetedms/parser/skyaudit/SkylineAuditLogParser.java @@ -31,7 +31,6 @@ import org.labkey.targetedms.parser.XmlUtil; import org.xml.sax.SAXException; -import javax.xml.XMLConstants; import javax.xml.stream.XMLStreamException; import javax.xml.stream.XMLStreamReader; import javax.xml.transform.stream.StreamSource; @@ -114,10 +113,10 @@ private void validateXml() throws IOException, SAXException, AuditLogParsingExce try (InputStream schemaStream = new BufferedInputStream(openSchemaInputStream()); InputStream auditLogStream = new BufferedInputStream(new FileInputStream(_file))) { - //prepare validator - SchemaFactory schemaFactory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); + //prepare validator, hardened against XXE (CWE-611) since the audit log is attacker-supplied + SchemaFactory schemaFactory = XmlBeansUtil.schemaFactory(); Schema schema = schemaFactory.newSchema(new StreamSource(schemaStream)); - Validator validator = schema.newValidator(); + Validator validator = XmlBeansUtil.hardenValidator(schema.newValidator()); validator.validate(new StreamSource(auditLogStream)); } }