Java: `java/xxe` doesn't cover public XML helper methods that parse caller-provided input

java/xxe クエリと、既存のパーサー構築シンクおよび安全な設定のモデリングから始めます。InputStream、String、Reader、または URL の値を DocumentBuilderFactory.parse に渡す公開ヘルパーについてカバレッジを確認し、その後、類似する SAXParserFactory および XMLInputFactory のエントリーポイントと比較します。完了条件は、既存の結果を失うことなく、説明したヘルパーの形状と単純なラッパーに対する findings をテストで示せることです。

This looks like a gap in java/xxe around library-style XML helpers. If a public helper takes caller-provided XML as an InputStream, String, Reader, or URL, builds a DocumentBuilderFactory without XXE hardening, and then calls newDocumentBuilder().parse(...), I wouldn't expect that to fall out of coverage.

CodeQL already seems to model the parser sink and the usual safe configs here, and it still finds other java/xxe results in the same codebase, so this doesn't look like a missing sink or a failed analysis. It looks more like these public parsing entry points are not treated as strong enough sources for this query. That's a pretty normal pattern in SDK helpers, XML utility classes, metadata loaders, and config parsers, where the trust boundary is the method parameter rather than a controller or request object.

The aws-sdk-android fix for CVE-2022-4725 is a good example: both RegionMetadataParser.parse(InputStream) and XpathUtils.documentFrom(...) were fixed by adding the standard DocumentBuilderFactory hardening.

Semgrep's documentbuilderfactory-disallow-doctype-decl-missing rule catches the same shape by reusing the existing parser-construction sink and checking for missing hardening, which makes this seem like a fairly local modeling issue.

My guess is that java/xxe could cover this by recognizing public parse helpers that feed caller-controlled XML directly, or through trivial wrappers, into the existing XXE sinks. I would expect the same hole to show up for similar helper methods built around SAXParserFactory and XMLInputFactory too.

import java.io.InputStream;
import javax.xml.parsers.DocumentBuilderFactory;

class XmlHelper {
    public static void parse(InputStream in) throws Exception {
        DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
        var b = f.newDocumentBuilder();
        b.parse(in);
    }
}