From 56cffe5f0ceb30a5b1d6446df0fe31378b521422 Mon Sep 17 00:00:00 2001
From: insaf021 <insaf@digiscrypt.com>
Date: Thu, 30 Jul 2026 15:47:38 +0530
Subject: [PATCH] security: disable XML DTD processing in XmlPullParser to
 prevent XXE

Fixes googleapis/google-http-java-client#2179
---
 .../java/com/google/api/client/xml/Xml.java   |  8 ++++++-
 .../com/google/api/client/xml/XmlTest.java    | 23 +++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/google-http-client-xml/src/main/java/com/google/api/client/xml/Xml.java b/google-http-client-xml/src/main/java/com/google/api/client/xml/Xml.java
index a5132839c..ef8e050fe 100644
--- a/google-http-client-xml/src/main/java/com/google/api/client/xml/Xml.java
+++ b/google-http-client-xml/src/main/java/com/google/api/client/xml/Xml.java
@@ -87,7 +87,13 @@ public static XmlSerializer createSerializer() {
 
   /** Returns a new XML pull parser. */
   public static XmlPullParser createParser() throws XmlPullParserException {
-    return getParserFactory().newPullParser();
+    XmlPullParser parser = getParserFactory().newPullParser();
+    try {
+      parser.setFeature(XmlPullParser.FEATURE_PROCESS_DOCDECL, false);
+    } catch (XmlPullParserException e) {
+      // Ignore if the feature is not supported
+    }
+    return parser;
   }
 
   /**
diff --git a/google-http-client-xml/src/test/java/com/google/api/client/xml/XmlTest.java b/google-http-client-xml/src/test/java/com/google/api/client/xml/XmlTest.java
index d9a381424..eb84f1c34 100644
--- a/google-http-client-xml/src/test/java/com/google/api/client/xml/XmlTest.java
+++ b/google-http-client-xml/src/test/java/com/google/api/client/xml/XmlTest.java
@@ -23,6 +23,7 @@
 import com.google.api.client.util.ArrayMap;
 import com.google.api.client.util.Key;
 import java.io.ByteArrayOutputStream;
+import java.io.IOException;
 import java.io.StringReader;
 import java.util.ArrayList;
 import java.util.Collection;
@@ -31,6 +32,7 @@
 import org.junit.runner.RunWith;
 import org.junit.runners.JUnit4;
 import org.xmlpull.v1.XmlPullParser;
+import org.xmlpull.v1.XmlPullParserException;
 import org.xmlpull.v1.XmlSerializer;
 
 /**
@@ -621,4 +623,25 @@ private static class AllType {
     @Key public String[] stringArray;
     @Key public List<Integer> integerCollection;
   }
+
+  @Test
+  public void testCreateParser_disablesDocDecl() throws Exception {
+    XmlPullParser parser = Xml.createParser();
+    String xmlWithDtd = "<?xml version=\"1.0\"?>\n"
+        + "<!DOCTYPE any [\n"
+        + "  <!ENTITY xxe \"injected\">\n"
+        + "]>\n"
+        + "<any>&xxe;</any>";
+    parser.setInput(new StringReader(xmlWithDtd));
+    try {
+      SimpleTypeString xml = new SimpleTypeString();
+      XmlNamespaceDictionary namespaceDictionary = new XmlNamespaceDictionary().set("", "");
+      Xml.parseElement(parser, xml, namespaceDictionary, null);
+      if (xml.value != null) {
+        assertTrue(xml.value.isEmpty() || xml.value.equals("&xxe;"));
+      }
+    } catch (XmlPullParserException | IOException e) {
+      // Expected exception if the parser fails on DOCDECL
+    }
+  }
 }