[Copilot]

Sonar java:S2755 flagged AstSchemaParser for parsing XML without explicit hardening against external entity abuse. This change secures DocumentBuilderFactory configuration while preserving AST generation from Ast.xml.

• Parser hardening

  • Enabled JAXP secure processing on DocumentBuilderFactory.
  • Disabled DOCTYPE declarations to block XXE entry points during schema parsing.

• Targeted regression coverage

  • Added a focused test in AstSchemaParserTest that feeds XML containing a DOCTYPE/entity declaration.
  • Asserts parser rejection via SAXParseException and DOCTYPE-related error text to validate the intended failure path.

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
DocumentBuilder builder = factory.newDocumentBuilder();

• Fixes Configure XML parser with secure processing in AstSchemaParser (Sonar S2755) #23

[Copilot]

🟡 Changes recommended

Although the change is correct and low-risk, it is a security-related modification that warrants final human sign-off before approval.

0 open findings

What changed in this PR

This PR hardens AstSchemaParser against XML External Entity (XXE) attacks, addressing SonarCloud rule java:S2755 (issue #23). The parser reads the Ast.xml schema to generate Java AST node classes, so it processes trusted project input, but the hardening removes the flagged vulnerability and documents the secure-parsing intent. The change enables JAXP secure processing and disallows DOCTYPE declarations on the DocumentBuilderFactory, and adds a regression test proving a DOCTYPE/entity document is rejected.

Changes:

• Enabled FEATURE_SECURE_PROCESSING and disallow-doctype-decl on DocumentBuilderFactory before building the parser.
• Added testRejectsDocTypeDeclaration asserting a SAXParseException mentioning DOCTYPE is thrown for XXE-style input.

File	Description
tsql-scriptdom-astgen/​src/​main/​java/​io/​github/​fupacat/​AstSchemaParser.java	Configures the XML parser factory with secure processing and DOCTYPE rejection to prevent XXE.
tsql-scriptdom-astgen/​src/​test/​java/​io/​github/​fupacat/​AstSchemaParserTest.java	Adds a regression test verifying DOCTYPE/entity input is rejected with a SAXParseException.

The change is minimal, correct, and well-scoped: features are set on the factory before newDocumentBuilder(), the checked ParserConfigurationException propagates via the existing throws Exception, Java 17 (per pom.xml) fully supports the text-block test, and the existing testParseAstXml confirms the real Ast.xml (which has no DOCTYPE) still parses successfully. The new test correctly asserts the standard JDK/Xerces message, which contains DOCTYPE. No issues were found.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approved

The two-line parser hardening is correct and complete, applies to the only XML parser in the codebase, and is backed by an accurate regression test.

0 open findings

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

The new XXE-rejection test is attributed to REQ-001 (defined as parsing Ast.xml to load definitions), leaving the added security behavior without its own backing SRS requirement in the enforced MCSWE traceability pipeline.

1 open finding

• Misattributed XXE test under REQ-001 · New

🧠 Review effort: Balanced