{"record":{"id":"886cd1cf580e767f","repo":"jeecgboot/JeecgBoot","slug":"xml-parsing-error-exception","errorCode":null,"errorMessage":"XML parsing error: {exception}","messagePattern":"XML parsing error: (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/cas/util/XmlUtils.java","lineNumber":62,"sourceCode":"     * @return DOM document.\n     */\n    public static Document newDocument(final String xml) {\n        final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();\n        final Map<String, Boolean> features = new HashMap(5);\n        features.put(XMLConstants.FEATURE_SECURE_PROCESSING, true);\n        features.put(\"http://apache.org/xml/features/nonvalidating/load-external-dtd\", false);\n        for (final Map.Entry<String, Boolean> entry : features.entrySet()) {\n            try {\n                factory.setFeature(entry.getKey(), entry.getValue());\n            } catch (ParserConfigurationException e) {\n                log.warn(\"Failed setting XML feature {}: {}\", entry.getKey(), e);\n            }\n        }\n        factory.setNamespaceAware(true);\n        try {\n            return factory.newDocumentBuilder().parse(new InputSource(new StringReader(xml)));\n        } catch (Exception e) {\n            throw new RuntimeException(\"XML parsing error: \" + e);\n        }\n    }\n\n    /**\n     * Get an instance of an XML reader from the XMLReaderFactory.\n     *\n     * @return the XMLReader.\n     */\n    public static XMLReader getXmlReader() {\n        try {\n            //update-begin---author:wangshuai---date:2026-03-30---for:【issues/9422】XmlUtils.extractCustomAttributes可能存在疑似的外部实体依赖漏洞---\n            final SAXParserFactory spf = SAXParserFactory.newInstance();\n            spf.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\n            spf.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);\n            spf.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false);\n            spf.setFeature(\"http://apache.org/xml/features/nonvalidating/load-external-dtd\", false);\n            final XMLReader reader = spf.newSAXParser().getXMLReader();\n            //update-end---author:wangshuai---date:2026-03-30---for:【issues/9422】XmlUtils.extractCustomAttributes可能存在疑似的外部实体依赖漏洞---","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/cas/util/XmlUtils.java#L44-L80","documentation":"XmlUtils parses the CAS XML response using a hardened DocumentBuilderFactory (disallow-doctype, external entities off, load-external-dtd off -- XXE hardening for issues/9422). Any SAX/IOException during DocumentBuilder.parse() is wrapped as RuntimeException 'XML parsing error: <exception>'. Note the exception's toString (not just message) is appended.","triggerScenarios":"The CAS server response is not well-formed XML; the body is empty or an HTML error page; encoding mismatch; truncated response from a proxy.","commonSituations":"CAS endpoint returns HTML (login page / error) instead of XML; TLS interception by a proxy injecting content; network timeout producing a partial body; CAS misroute.","solutions":["Log the raw 'res' string before parsing to see the actual payload.","Verify the CAS validation endpoint (prefixUrl + '/p3/serviceValidate') is reachable and returns XML.","Check for TLS/proxy issues intercepting the response.","Handle a non-XML response as an authentication failure rather than a parse error."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// guard: only attempt parse if the body looks like XML\nif (res == null || !res.trim().startsWith(\"<\")) {\n    throw new IllegalStateException(\"CAS 返回非 XML 内容: \" + res);\n}","typeGuard":null,"tryCatchPattern":"try {\n    return factory.newDocumentBuilder().parse(new InputSource(new StringReader(xml)));\n} catch (Exception e) {\n    log.error(\"XML 解析失败，原始内容: {}\", xml, e);\n    throw new RuntimeException(\"XML parsing error: \" + e);\n}","preventionTips":["Sanity-check that the CAS endpoint returns XML (starts with '<') before parsing.","Resolve TLS/proxy issues that turn XML into HTML error pages.","Keep XXE hardening features enabled."],"tags":["cas","xml","parsing","xxe","network"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}