Property 'http://www.oracle.com/xml/jaxp/properties/entityExpansionLimit' is not recognized

On 01-05-2025 16:35, ykhabins at bellsouth.net wrote: > Hello, > > Congrats on the BaseX 11.9 release! > > Installed it, and started to run my XQuery tests. > Right away I got the following error: > "Property 'http://www.oracle.com/xml/jaxp/properties/entityExpansionLimit' > is not recognized."

Von: ykhabins at bellsouth.net An: basex-talk at mailman.uni-konstanz.de Betreff: [basex-talk] Property 'http://www.oracle.com/xml/jaxp/properties/entityExpansionLimit' is not recognized Hello, Congrats on the BaseX 11.9 release! Installed it, and started to run my XQuery tests. Right away I got the following error: "Property 'http://www.oracle.com/xml/jaxp/properties/entityExpansionLimit' is not recognized." Both doc() and collection() are tripping on it. A full repro is below. XQuery #1 ============================================= declare variable $base_dir as xs:string := 'e:\Temp\'; for $docx in collection($base_dir) return $docx XQuery #2 ============================================= declare variable $base_dir as xs:string := 'e:\Temp\'; for $file in file:list($base_dir, false(), 'books*.xml') let $docx := doc($base_dir || $file) return $docx Regards, Yitzhak Khabinsky

>> "...Presumably there is some other SAX parser factory on your classpath, e.g. Xerces. Can you confirm this?..."

Von: ykhabins at bellsouth.net An: basex-talk at mailman.uni-konstanz.de Betreff: [basex-talk] Re: Property 'http://www.oracle.com/xml/jaxp/properties/entityExpansionLimit' is not recognized Hi Gunther, >> "...Presumably there is some other SAX parser factory on your classpath, e.g. Xerces. Can you confirm this?..." That's correct!!! I am using BaseX for the following tasks: - XSD 1.1 validations via Xerces-J 2.12.2 - XSLT 3.0 transformations via Saxon-HE 12.5 To do that, and following official BaseX way, their assemblies are copied to the following directory: c:\Program Files (x86)\BaseX\lib\custom Here is a list of Xerces jar files: c:\Program Files (x86)\BaseX\lib\custom\icu4j-69_1.jar c:\Program Files (x86)\BaseX\lib\custom\cupv10k-runtime.jar c:\Program Files (x86)\BaseX\lib\custom\org.eclipse.wst.xml.xpath2.processor_1.2.1.jar c:\Program Files (x86)\BaseX\lib\custom\xercesImpl.jar c:\Program Files (x86)\BaseX\lib\custom\xml-apis.jar Here is a list of Saxon jar files: c:\Program Files (x86)\BaseX\lib\custom\lib\jline-2.14.6.jar c:\Program Files (x86)\BaseX\lib\custom\lib\xmlresolver-5.2.2.jar c:\Program Files (x86)\BaseX\lib\custom\lib\xmlresolver-5.2.2-data.jar c:\Program Files (x86)\BaseX\lib\custom\saxon-he-12.5.jar c:\Program Files (x86)\BaseX\lib\custom\saxon-he-test-12.5.jar c:\Program Files (x86)\BaseX\lib\custom\saxon-he-xqj-12.5.jar In such case, will it work the suggestion to tweak the SAXParserFactory setting? And where exactly should I put that line? javax.xml.parsers.SAXParserFactory=com.sun.org.apache.xerces.internal.jaxp.SAXParserFactoryImpl Regards, Yitzhak Khabinsky

Von: "Nico Verwer (Rakensi)" <nverwer at rakensi.com> An: basex-talk at mailman.uni-konstanz.de Betreff: [basex-talk] Security problem in 11.9? Hello everyone on the list! There is a change between 11.8 and 11.9, related to security settings. This has to do with the following document: <?xml version="1.0"?> <!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe SYSTEM "file:///" > ]> <foo>&xxe;</foo> When parsing this document, BaseX11.8 threw an error with code err:FODC0002, which means that the resource cannot be retrieved. BaseX 11.9 gives a listing of the root directory of my computer. This can be used to retrieve all files on my computer, which is a security risk.

On Fri, May 2, 2025 at 2:14 PM <ykhabins at bellsouth.net> wrote: > Hi Gunther, > > >> "...Presumably there is some other SAX parser factory on your > classpath, e.g. Xerces. Can you confirm this?..." > > That's correct!!! > > I am using BaseX for the following tasks: > - XSD 1.1 validations via Xerces-J 2.12.2 > - XSLT 3.0 transformations via Saxon-HE 12.5 > > To do that, and following official BaseX way, their assemblies are copied > to the following directory: > c:\Program Files (x86)\BaseX\lib\custom > > Here is a list of Xerces jar files: > c:\Program Files (x86)\BaseX\lib\custom\icu4j-69_1.jar > c:\Program Files (x86)\BaseX\lib\custom\cupv10k-runtime.jar > c:\Program Files > (x86)\BaseX\lib\custom\org.eclipse.wst.xml.xpath2.processor_1.2.1.jar > c:\Program Files (x86)\BaseX\lib\custom\xercesImpl.jar > c:\Program Files (x86)\BaseX\lib\custom\xml-apis.jar > > Here is a list of Saxon jar files: > c:\Program Files (x86)\BaseX\lib\custom\lib\jline-2.14.6.jar > c:\Program Files (x86)\BaseX\lib\custom\lib\xmlresolver-5.2.2.jar > c:\Program Files (x86)\BaseX\lib\custom\lib\xmlresolver-5.2.2-data.jar > c:\Program Files (x86)\BaseX\lib\custom\saxon-he-12.5.jar > c:\Program Files (x86)\BaseX\lib\custom\saxon-he-test-12.5.jar > c:\Program Files (x86)\BaseX\lib\custom\saxon-he-xqj-12.5.jar > > In such case, will it work the suggestion to tweak the SAXParserFactory > setting? > And where exactly should I put that line? > > javax.xml.parsers.SAXParserFactory=com.sun.org > .apache.xerces.internal.jaxp.SAXParserFactoryImpl > > > Regards, > Yitzhak Khabinsky >

> > […] is gone. >

Overall, it was a such breaking change, a big scare! IMHO, it is much > better and cleaner to stay away from the environment variable. >

<ykhabins at bellsouth.net> schrieb am Mo., 5. Mai 2025, 14:14: > Mr. Grun, > > I specified in this thread earlier that I am using BaseX for the following > tasks: > - XSD 1.1 validations via Xerces-J 2.12.2 > - XSLT 3.0 transformations via Saxon-HE 12.5 > > All their files that are in the custom directory are enlisted also. > > Regards, > Yitzhak Khabinsky >

On Mon, May 5, 2025 at 2:51 PM <ykhabins at bellsouth.net> wrote: > Mr. Grun, > > To facilitate testing on your side, here is their downloads. > > https://xerces.apache.org/mirrors.cgi > > https://dlcdn.apache.org//xerces/j/binaries/Xerces-J-bin.2.12.2-xml-schema-1.1.zip > > https://www.saxonica.com/download/java.xml > > https://github.com/Saxonica/Saxon-HE/releases/download/SaxonHE12-6/SaxonHE12-6J.zip > > Regards, > Yitzhak Khabinsky >

> Gesendet: Samstag, 3. Mai 2025 um 01:19 > Von: "Gunther Rademacher" <grd at gmx.net> > An: nverwer at rakensi.com, basex-talk at mailman.uni-konstanz.de > > Betreff: Re: [basex-talk] Security problem in 11.9? > > Hi Nico, > > what you describe is the expected behaviour. Please be aware of the > recent changes of fn:doc (and also fn:parse-xml) that were made in > 11.9. > > These functions now support options to control the access of > external entities, in particular > > - allow-external-entities: whether external entities are > permitted (true) or rejected (false), default true > - dtd: whether external entities are processed (true) or > ignored (false), default true. > > In fact option dtd is not completely new, but previously its value > was taken from the context option DTD, which defaults to false. So > with 11.8, you could produce the same directory listing, that you > experienced with 11.9, by running this on the document that you > provided: > > basex -ODTD=yes "doc('doc.xml')" > > Now the options can be supplied per function call, they are > independent of the context options, and the defaults are different. > To restore the result that you were used to with 11.9, you need to > run: > > basex "doc('doc.xml', { 'dtd': false() })" > > You can now also run this in order to reject any external entity > references: > > basex "doc('doc.xml', { 'allow-external-entities': false() })" > > The changes were made to implement the XQuery 4.0 specification > of these functions: > > https://qt4cg.org/specifications/xpath-functions-40/Overview.html#func-doc > https://qt4cg.org/specifications/xpath-functions-40/Overview.html#func-parse-xml > > This is also described here: > > https://docs.basex.org/12/Standard_Functions#fn:doc > https://docs.basex.org/12/Standard_Functions#fn:parse-xml > > Best regards, > Gunther > Gesendet: Donnerstag, 3. Juli 2025 um 13:39 > Von: nverwer at rakensi.com > An: basex-talk at mailman.uni-konstanz.de > Betreff: [basex-talk] Re: Security problem in 11.9? > > The issue in my message from 2 May still exists in BaseX 12. > > The issue had to do with the following document: > > <!DOCTYPE foo [ > <!ELEMENT foo ANY > > <!ENTITY xxe SYSTEM "file:///" > > ]> > <foo>&xxe;</foo> > > This returns a document with a listing of the root of my file system. From there, I can enter sub-directories and extract files. > This is a well-known external entity injection [https://portswigger.net/web-security/xxe#exploiting-xxe-to-retrieve-files]. > This is present in both the standard and the internal parser. > Currently, I can prevent this by running BaseX as a user with few permissions, but it would be better to be able to prevent this kind of entity expansion. > > For my application, I need to process files sent by external users. And before that, I need to pass the security checks that my client performs. > > Is this considered by other BaseX users to be a vulnerability? Why was it not present in BaseX 11.8? How (if at all) can it be solved? >

Von: Gunther Rademacher via BaseX-Talk <basex-talk at mailman.uni-konstanz.de> Gesendet: Donnerstag, Juli 3, 2025 7:28:14 PM An: nverwer at rakensi.com <nverwer at rakensi.com>; basex-talk at mailman.uni-konstanz.de <basex-talk at mailman.uni-konstanz.de> Betreff: [basex-talk] Re: Security problem in 11.9? Hi Nico, I’ve pasted my reply from May 3 below, in case it was missed. From my perspective, that should address the issue - please let me know if you see it differently. Best regards, Gunther > Gesendet: Samstag, 3. Mai 2025 um 01:19 > Von: "Gunther Rademacher" <grd at gmx.net> > An: nverwer at rakensi.com, basex-talk at mailman.uni-konstanz.de > > Betreff: Re: [basex-talk] Security problem in 11.9? > > Hi Nico, > > what you describe is the expected behaviour. Please be aware of the > recent changes of fn:doc (and also fn:parse-xml) that were made in > 11.9. > > These functions now support options to control the access of > external entities, in particular > > - allow-external-entities: whether external entities are > permitted (true) or rejected (false), default true > - dtd: whether external entities are processed (true) or > ignored (false), default true. > > In fact option dtd is not completely new, but previously its value > was taken from the context option DTD, which defaults to false. So > with 11.8, you could produce the same directory listing, that you > experienced with 11.9, by running this on the document that you > provided: > > basex -ODTD=yes "doc('doc.xml')" > > Now the options can be supplied per function call, they are > independent of the context options, and the defaults are different. > To restore the result that you were used to with 11.9, you need to > run: > > basex "doc('doc.xml', { 'dtd': false() })" > > You can now also run this in order to reject any external entity > references: > > basex "doc('doc.xml', { 'allow-external-entities': false() })" > > The changes were made to implement the XQuery 4.0 specification > of these functions: > > https://qt4cg.org/specifications/xpath-functions-40/Overview.html#func-doc > https://qt4cg.org/specifications/xpath-functions-40/Overview.html#func-parse-xml > > This is also described here: > > https://docs.basex.org/12/Standard_Functions#fn:doc > https://docs.basex.org/12/Standard_Functions#fn:parse-xml > > Best regards, > Gunther

> I’ve pasted my reply from May 3 below, in case it was missed. From my > perspective, that should address the issue - please let me know if you > see it differently.

> @Nico: In invite you to join the ongoing discussion on sane/safe > defaults for the fn:doc and fn:parse-xml functions in the qtspecs > repository [1]. User feedback is always appreciated. > > Best, > Christian > > [1] https://github.com/qt4cg/qtspecs/issues/2034