Harden GMLReader against XXE (use Commons Secure XML)

modules/core/pom.xml

@@ -14,8 +14,32 @@
         <doclint>none</doclint>
     </properties>
 
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-secure-xml</artifactId>
+        </dependency>
+    </dependencies>
+
     <build>
         <plugins>
+            <plugin>
+                <groupId>de.thetaphi</groupId>
+                <artifactId>forbiddenapis</artifactId>
+                <configuration>
+                    <failOnUnsupportedJava>false</failOnUnsupportedJava>
+                    <signaturesFiles>
+                        <signaturesFile>${project.basedir}/src/conf/forbidden-sax-factories.txt</signaturesFile>
+                    </signaturesFiles>
+                </configuration>
+                <executions>
+                    <execution>
+                        <goals>
+                            <goal>check</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
             <plugin>
                 <artifactId>maven-jar-plugin</artifactId>
                 <configuration>

modules/core/src/conf/forbidden-sax-factories.txt

@@ -0,0 +1,12 @@
+# Raw SAX factories parse with the implementation's defaults, which fetch external DTDs
+# and resolve external entities. Create SAX parsers through Apache Commons Secure XML instead.
+@defaultMessage Create SAX parsers through org.apache.commons.xml.secure.SecureSAXParserFactory, which never resolves external DTDs or entities
+@ignoreUnresolvable
+javax.xml.parsers.SAXParserFactory#newInstance()
+javax.xml.parsers.SAXParserFactory#newInstance(java.lang.String,java.lang.ClassLoader)
+javax.xml.parsers.SAXParserFactory#newDefaultInstance()
+javax.xml.parsers.SAXParserFactory#newDefaultNSInstance()
+javax.xml.parsers.SAXParserFactory#newNSInstance()
+javax.xml.parsers.SAXParserFactory#newNSInstance(java.lang.String,java.lang.ClassLoader)
+org.xml.sax.helpers.XMLReaderFactory#createXMLReader()
+org.xml.sax.helpers.XMLReaderFactory#createXMLReader(java.lang.String)

modules/core/src/main/java/org/locationtech/jts/io/gml2/GMLReader.java

@@ -19,6 +19,7 @@
 import javax.xml.parsers.SAXParser;
 import javax.xml.parsers.SAXParserFactory;
 
+import org.apache.commons.xml.secure.SecureSAXParserFactory;
 import org.locationtech.jts.geom.Geometry;
 import org.locationtech.jts.geom.GeometryCollection;
 import org.locationtech.jts.geom.GeometryFactory;
@@ -49,9 +50,15 @@
  *
  * The reader ignores namespace prefixes, 
  * and disables both the validation and namespace options on the <tt>SAXParser</tt>.
- * This class requires the presence of a SAX Parser available via the 
- * {@link javax.xml.parsers.SAXParserFactory#newInstance()}
- * method.
+ * <p>
+ * The parser is created by {@link SecureSAXParserFactory} from Apache Commons Secure XML,
+ * so external DTDs and external entities are never resolved
+ * and internal entity expansion is bounded,
+ * whichever SAX implementation is on the classpath.
+ * See its <a href="https://commons.apache.org/proper/commons-secure-xml/apidocs/org/apache/commons/xml/secure/package-summary.html">package documentation</a>
+ * for the guarantees
+ * and the <a href="https://commons.apache.org/proper/commons-secure-xml/threat_model.html#Downstream_Responsibility">threat model</a>
+ * for what remains the caller's responsibility.
  * <p>
  * A specification of the GML XML format 
  * can be found at the OGC web site: <a href='http://www.opengeospatial.org/'>http://www.opengeospatial.org/</a>.
@@ -101,7 +108,7 @@ public Geometry read(String gml, GeometryFactory geometryFactory) throws SAXExce
 	 * @throws IOException
 	 */
 	public Geometry read(Reader reader, GeometryFactory geometryFactory) throws SAXException, IOException, ParserConfigurationException{
-		SAXParserFactory fact = SAXParserFactory.newInstance();
+		SAXParserFactory fact = SecureSAXParserFactory.newInstance();
 
 		fact.setNamespaceAware(false);
 		fact.setValidating(false);

pom.xml

@@ -33,6 +33,7 @@
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <commons-secure-xml-version>1.0.0</commons-secure-xml-version>
         <junit-version>4.13.1</junit-version>
         <jdom-version>2.0.6.1</jdom-version>
         <jump.version>1.2</jump.version>
@@ -106,6 +107,11 @@
                 <artifactId>junit</artifactId>
                 <version>${junit-version}</version>
             </dependency>
+            <dependency>
+                <groupId>org.apache.commons</groupId>
+                <artifactId>commons-secure-xml</artifactId>
+                <version>${commons-secure-xml-version}</version>
+            </dependency>
             <dependency>
                 <groupId>org.jdom</groupId>
                 <artifactId>jdom2</artifactId>
@@ -215,6 +221,11 @@
                   <artifactId>maven-checkstyle-plugin</artifactId>
                   <version>3.1.2</version>
                 </plugin>
+                <plugin>
+                    <groupId>de.thetaphi</groupId>
+                    <artifactId>forbiddenapis</artifactId>
+                    <version>3.10</version>
+                </plugin>
                 <plugin>
                     <artifactId>maven-compiler-plugin</artifactId>
                     <version>3.8.1</version>
@@ -308,6 +319,9 @@
                     <header>${project.name} ${project.version}</header>
                     <overview></overview>
                     <excludePackageNames>org.locationtech.jtsexample.*,org.locationtech.jtstest,org.locationtech.jtstest.*</excludePackageNames>
+                    <links>
+                        <link>https://javadoc.io/doc/org.apache.commons/commons-secure-xml/${commons-secure-xml-version}</link>
+                    </links>
                     <groups>
                         <group>
                             <title>Core - Geometry</title>