Don't download external entities when parsing catalog files.

[gigermocas]

Hello,

I currently have all my catalog files defined with the corresponding DTD, eg:

<!DOCTYPE catalog
	PUBLIC "-//OASIS//DTD XML Catalogs V1.1//EN" "http://www.oasis-open.org/committees/entity/release/1.1/catalog.dtd">
<catalog xmlns="urn:oasis:names:tc:entity:xmlns:xml:catalog"
         prefer="public">
	<!-- ... -->
</catalog>

The problem I'm having at the moment is that my builds are all failing because the OASIS site is having issues:
[ERROR] Failed to execute goal org.jvnet.jaxb:jaxb-maven-plugin:4.0.8:generate (generate) on project <...> Error parsing catalog [file:/<...>/src/main/resources/catalog.xml] Server returned HTTP response code: 502 for URL: http://www.oasis-open.org/committees/entity/release/1.1/catalog.dtd -> [Help 1]

Is the downloading of external entities actually required for parsing the catalog files? Something like this at least should be disabled by default due to security concerns.

My workaround was to remove the DTD declaration from the files, but I think the tool should(?) handle this.

[laurentschoelens]

Hi @gigermocas

From what I know of catalog files, there is many possibilities and syntax available.
I've to dig in jaxb-xjc tool itself to see what is happening here.

Could you create Minimal Reproductible Example in the meantime ? I guess having a corporate proxy should trigger the problem too

Thanks

[gigermocas]

Hi @laurentschoelens

Today the DTD is giving me a 403, they seem to be moving stuff around...

For what is worth, the general guidance seems to be to disable DTDs completely:
XML External Entity Prevention Cheat Sheet

I'm already doing this on the parsers that I use on my codebase. Not sure if this is 100% applicable for this tool's usecase, but at least disabling by default seems like a sensible option.

Here is the MRE:
catalog-external-dtd-test.zip

Thanks

[laurentschoelens]

@gigermocas thanks for MRE

Issue tracked down and need to see if we can safely disable External DTD loading in catalog resolver.

I'll keep you updated when investigation will end