Use XMLHelper for secure XML processing in DBWS XRServiceFactory and ProviderHelper

[SebTardif]

Summary

XRServiceFactory.getDocumentBuilder() and getTransformer() create DocumentBuilderFactory and TransformerFactory via newInstance() without setting FEATURE_SECURE_PROCESSING, making them vulnerable to XXE attacks. The project already has XMLHelper with createDocumentBuilderFactory() and createTransformerFactory() that properly configure secure processing.

ProviderHelper.init() also creates a TransformerFactory directly without secure processing.

Changes

• XRServiceFactory.getDocumentBuilder(): Replace DocumentBuilderFactory.newInstance() with XMLHelper.createDocumentBuilderFactory(false). This also sets namespaceAware(true) internally, so the explicit call is removed.
• XRServiceFactory.getTransformer(): Replace TransformerFactory.newInstance() with XMLHelper.createTransformerFactory(false).
• ProviderHelper.init(): Replace TransformerFactory.newInstance() with XMLHelper.createTransformerFactory(false).

All three changes delegate to the existing XMLHelper infrastructure that the rest of the codebase uses for secure XML factory creation.

Testing

• DBWS module compiles successfully
• All DBWS integration tests pass (10 tests, 0 failures)

Related

• Related to #1613 (ObjectInputFilter for FileBasedProjectCache), which addressed a similar pattern of missing security configuration in another module.

Signed-off-by: Sebastien Tardif SebTardif@ncf.ca

[robertpatrick]

@SebTardif The change looks straightforward, and the existing integration coverage provides useful reassurance about normal DBWS behavior.

Before merging, could you please:

• Refresh the branch against the current master branch.
• Add small, database-free regression tests through XRServiceFactory.getDocumentBuilder() and getTransformer(), confirming that ordinary, namespaced XML still works and external entities are not resolved under the default security configuration.

One test-wiring detail: DBWS currently skips Surefire and explicitly selects Failsafe suites, so please ensure the new tests are included in an execution that CI actually runs.

[SebTardif]

@robertpatrick

Before merging, could you please:

• Refresh the branch against the current master branch.
• Add small, database-free regression tests through XRServiceFactory.getDocumentBuilder() and getTransformer(), confirming that ordinary, namespaced XML still works and external entities are not resolved under the default security configuration.

Yes. The branch is rebased on current master, and Failsafe now runs XRServiceFactorySecureXmlTestSuite without a database.

The suite is in the existing test-dbws include list (Surefire stays skipped). It checks namespaced parse and identity transform, and that file-backed external entities are not resolved under the default XMLHelper configuration.

[robertpatrick]

@arjantijms LGTM

[arjantijms]

Thanks @robertpatrick and @SebTardif The tests pass, so let's merge this