Harden AstSchemaParser against XXE by enforcing secure JAXP features

tsql-scriptdom-astgen/src/main/java/io/github/fupacat/AstSchemaParser.java

@@ -1,12 +1,15 @@
 package io.github.fupacat;
 
 import java.io.InputStream;
+import javax.xml.XMLConstants;
 
 public class AstSchemaParser {
 
     // TRACEABILITY_MAPPING: REQ-001
     public AstModel parse(InputStream inputStream) throws Exception {
         javax.xml.parsers.DocumentBuilderFactory factory = javax.xml.parsers.DocumentBuilderFactory.newInstance();
+        factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
         javax.xml.parsers.DocumentBuilder builder = factory.newDocumentBuilder();
         org.w3c.dom.Document doc = builder.parse(inputStream);
         doc.getDocumentElement().normalize();

tsql-scriptdom-astgen/src/test/java/io/github/fupacat/AstSchemaParserTest.java

@@ -1,8 +1,11 @@
 package io.github.fupacat;
 
 import org.junit.jupiter.api.Test;
+import java.io.ByteArrayInputStream;
 import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
 public class AstSchemaParserTest {
 
@@ -20,4 +23,25 @@ public void testParseAstXml() throws Exception {
             assertThat(model.interfaces).isNotEmpty();
         }
     }
+
+    // TRACEABILITY_MAPPING: REQ-001
+    @Test
+    public void testRejectsDocTypeDeclaration() {
+        AstSchemaParser parser = new AstSchemaParser();
+        String xml = """
+                <!DOCTYPE Ast [
+                  <!ENTITY xxe SYSTEM "file:///etc/passwd">
+                ]>
+                <Ast>
+                  <Class Name="A" Summary="s">
+                    <Member Name="M" Type="string" Summary="&xxe;"/>
+                  </Class>
+                </Ast>
+                """;
+        InputStream inputStream = new ByteArrayInputStream(xml.getBytes(StandardCharsets.UTF_8));
+
+        assertThatThrownBy(() -> parser.parse(inputStream))
+                .isInstanceOf(org.xml.sax.SAXParseException.class)
+                .hasMessageContaining("DOCTYPE");
+    }
 }