[yogikortisa]

Summary

XmlModule.compile() — the Starlark xml.xpath(content, expression, type) function — parses the provided content with a default DocumentBuilderFactory:

DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = builderFactory.newDocumentBuilder();
Document xmlDocument = builder.parse(new ByteArrayInputStream(xmlContent.getBytes(...)));

A default DocumentBuilderFactory resolves DTDs and external entities. When the XML content comes from an untrusted source — for example a file read from a repository being migrated — a document such as:

<!DOCTYPE x [ <!ENTITY e SYSTEM "file:///etc/passwd"> ]>
<root>&e;</root>

enables XML External Entity (XXE) attacks on the host running Copybara: local file disclosure, server-side request forgery (http://… entities), and denial of service via entity expansion.

Fix

Disable DTD processing (disallow-doctype-decl, which also blocks entity resolution), XInclude, and entity-reference expansion before constructing the parser. XPath over normal XML content is unaffected.

[gemini-code-assist]

Code Review

This pull request updates the XmlModule.java file to secure the XML parser against XML External Entity (XXE) injection. It configures the DocumentBuilderFactory to disallow doctype declarations, disable XInclude, and disable expanding entity references. No review comments were provided, so there is no feedback to address.