Java: `java/xxe` doesn't cover public XML helper methods that parse caller-provided input

Bắt đầu với truy vấn java/xxe cùng sink xây dựng parser hiện có và mô hình hóa cấu hình an toàn. Kiểm tra độ bao phủ đối với các helper public truyền giá trị InputStream, String, Reader hoặc URL vào DocumentBuilderFactory.parse, sau đó so sánh với các entry point tương tự của SAXParserFactory và XMLInputFactory. Hoàn tất khi các test thể hiện được findings cho dạng helper được mô tả và các wrapper tầm thường mà không làm mất các kết quả hiện có.

This looks like a gap in java/xxe around library-style XML helpers. If a public helper takes caller-provided XML as an InputStream, String, Reader, or URL, builds a DocumentBuilderFactory without XXE hardening, and then calls newDocumentBuilder().parse(...), I wouldn't expect that to fall out of coverage.

CodeQL already seems to model the parser sink and the usual safe configs here, and it still finds other java/xxe results in the same codebase, so this doesn't look like a missing sink or a failed analysis. It looks more like these public parsing entry points are not treated as strong enough sources for this query. That's a pretty normal pattern in SDK helpers, XML utility classes, metadata loaders, and config parsers, where the trust boundary is the method parameter rather than a controller or request object.

The aws-sdk-android fix for CVE-2022-4725 is a good example: both RegionMetadataParser.parse(InputStream) and XpathUtils.documentFrom(...) were fixed by adding the standard DocumentBuilderFactory hardening.

Semgrep's documentbuilderfactory-disallow-doctype-decl-missing rule catches the same shape by reusing the existing parser-construction sink and checking for missing hardening, which makes this seem like a fairly local modeling issue.

My guess is that java/xxe could cover this by recognizing public parse helpers that feed caller-controlled XML directly, or through trivial wrappers, into the existing XXE sinks. I would expect the same hole to show up for similar helper methods built around SAXParserFactory and XMLInputFactory too.

import java.io.InputStream;
import javax.xml.parsers.DocumentBuilderFactory;

class XmlHelper {
    public static void parse(InputStream in) throws Exception {
        DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
        var b = f.newDocumentBuilder();
        b.parse(in);
    }
}