Db contrib/veracode CWE-611 (Improper Restriction of XML External Entity Reference)

[daniel-marian-buga-a-db]

Summary

This PR fixes CWE-611 (Improper Restriction of XML External Entity Reference) for XML transformation/writer paths in spin/dataformat-xml-dom.

Code changes

File: DomXmlDataFormat.java

Added enableSecureProcessing(TransformerFactory) method to harden transformer configuration.

Hardened defaultTransformerFactory() by configuring:

transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");

This protects both transformation sinks used by DomXmlDataFormatWriter:

• Pretty-print path:

  getFormattingTransformer().transform(...)

• Non-pretty-print path:

  getTransformer().transform(...)

Test changes

File: DomXmlDataFormatProtectionTest.java

Added test:

shouldDenyExternalStylesheetAccessInFormattingConfiguration()

The test:

• Creates an XSL that attempts to include an external stylesheet via: xsl:include href="file:..."
• Verifies configuration fails with SpinXmlDataFormatException
• Confirms external stylesheet resolution is blocked by secure transformer settings

Why this fix

Parser-side hardening already existed (DocumentBuilderFactory), but the writer-side TransformerFactory was not explicitly hardened.

This PR closes that gap and aligns with OWASP/JAXP XXE prevention guidance.

Validation

The implementation has been validated through:

• ✅ Successful local builds
• ✅ Successful mvn -pl spin/dataformat-all -am verify validation of the affected modules
• ✅ Successful full repository mvn verify
• ✅ Targeted, additional unit tests covering the newly introduced XXE protection logic

Impact Assessment

• Security hardening only: XXE/external resource resolution prevention in transformer path
• No functional behavior changes: valid internal XML/XSL processing is unaffected