[HADOOP-18469] Add XMLUtils methods to centralise code that creates secure XML parsers

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.3.4
• Fix Version/s: 3.4.0, 3.3.5
• Labels: pull-request-available
• Assignee: PJ Fanning
• Reporter: PJ Fanning
• Created: 27/Sep/22 10:30
• Updated: 14/Dec/22 18:22
• Resolved: 07/Oct/22 10:04

Description

Relates to HDFS-16766

There are other places in the code where DocumentBuilderFactory instances are created that could benefit from the same changes as HDFS-16766

sonatype-2022-5820

If anyone is landing on this page following the sonatype-2022-5820 alert, know that there is no known issue here, just a centralisation of all construction of XML parsers with lockdown of all the features.

Issue Links

• is related to: HDFS-16795 Use secure XML parser utils in hdfs classes
• is related to: MAPREDUCE-7411 Use secure XML parser utils in MapReduce
• is related to: YARN-11330 Use secure XML parser utils in YARN
• is related to: HADOOP-18575 Make XML transformer factory more lenient
• relates to: HDFS-16766 hdfs ec command loads (administrator provided) erasure code policy files without disabling xml entity expansion
• links to: GitHub Pull Request #4940
• links to: GitHub Pull Request #4978