Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/xerces2-j

              trunk @ cf0c517
            

Fixes

CVEs

HIGH

Peak severity

7.1%

Coverage

Highlights

XML External Entity (XXE): 6 prior fixes. Scrutinize any change in this area.

src/org/apache/xerces/validators/schema/TraverseSchema.java: most-fixed (2 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

XML External Entity (XXE): Failure to propagate security features (FEATURE_SECURE_PROCESSING) and the SecurityManager to underlying loaders (e.g., XMLSchemaLoader) allows attackers to bypass XML entity limits and security boundaries during schema validation.

SSRF: Schema inclusion and import mechanisms that bypass the user-configured EntityResolver allow malicious schemas to force the parser to perform Server-Side Request Forgery or read local files.

Sandbox Escape: Publicly visible utility classes like ObjectFactory can allow untrusted code to manipulate classloaders and load unauthorized classes, bypassing JVM sandbox constraints.