[CALCITE-5274] Improve DocumentBuilderFactory in DiffRepository test class by using secure features

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 1.32.0
• Component/s: extensions
• Labels: pull-request-available
• Assignee: Ruben Q L
• Reporter: PJ Fanning
• Created: 07/Sep/22 19:57
• Updated: 10/Sep/22 08:40
• Resolved: 08/Sep/22 18:59

Description

https://github.com/apache/calcite/pull/2892#discussion_r964468020

DocumentBuilderFactory use in DiffRepository needs changes like those in https://github.com/apache/calcite/pull/2892

There is also an issue with `this.doc = docBuilder.parse(refFile.openStream());` - the `refFile.openStream()` gives an InputStream that should be closed - try with resources pattern would make sense.

 

Issue Links

• relates to: CALCITE-5263 XML External Entity (XEE) vulnerability that allows a SQL query to read the contents of files via the SQL functions EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM or EXTRACT_VALUE (CVE-2022-39135)
• links to: GitHub Pull Request #2898