jeecgboot/JeecgBoot · error · RuntimeException

XML parsing error: {exception}

Error message

XML parsing error: {exception}

What it means

XmlUtils parses the CAS XML response using a hardened DocumentBuilderFactory (disallow-doctype, external entities off, load-external-dtd off -- XXE hardening for issues/9422). Any SAX/IOException during DocumentBuilder.parse() is wrapped as RuntimeException 'XML parsing error: <exception>'. Note the exception's toString (not just message) is appended.

Source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/cas/util/XmlUtils.java:62

     * @return DOM document.
     */
    public static Document newDocument(final String xml) {
        final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
        final Map<String, Boolean> features = new HashMap(5);
        features.put(XMLConstants.FEATURE_SECURE_PROCESSING, true);
        features.put("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
        for (final Map.Entry<String, Boolean> entry : features.entrySet()) {
            try {
                factory.setFeature(entry.getKey(), entry.getValue());
            } catch (ParserConfigurationException e) {
                log.warn("Failed setting XML feature {}: {}", entry.getKey(), e);
            }
        }
        factory.setNamespaceAware(true);
        try {
            return factory.newDocumentBuilder().parse(new InputSource(new StringReader(xml)));
        } catch (Exception e) {
            throw new RuntimeException("XML parsing error: " + e);
        }
    }

    /**
     * Get an instance of an XML reader from the XMLReaderFactory.
     *
     * @return the XMLReader.
     */
    public static XMLReader getXmlReader() {
        try {
            //update-begin---author:wangshuai---date:2026-03-30---for:【issues/9422】XmlUtils.extractCustomAttributes可能存在疑似的外部实体依赖漏洞---
            final SAXParserFactory spf = SAXParserFactory.newInstance();
            spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
            spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
            spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
            spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
            final XMLReader reader = spf.newSAXParser().getXMLReader();
            //update-end---author:wangshuai---date:2026-03-30---for:【issues/9422】XmlUtils.extractCustomAttributes可能存在疑似的外部实体依赖漏洞---

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Log the raw 'res' string before parsing to see the actual payload.
2. Verify the CAS validation endpoint (prefixUrl + '/p3/serviceValidate') is reachable and returns XML.
3. Check for TLS/proxy issues intercepting the response.
4. Handle a non-XML response as an authentication failure rather than a parse error.

// guard: only attempt parse if the body looks like XML
if (res == null || !res.trim().startsWith("<")) {
    throw new IllegalStateException("CAS 返回非 XML 内容: " + res);
}

try {
    return factory.newDocumentBuilder().parse(new InputSource(new StringReader(xml)));
} catch (Exception e) {
    log.error("XML 解析失败，原始内容: {}", xml, e);
    throw new RuntimeException("XML parsing error: " + e);
}

When it happens

Trigger: The CAS server response is not well-formed XML; the body is empty or an HTML error page; encoding mismatch; truncated response from a proxy.

Common situations: CAS endpoint returns HTML (login page / error) instead of XML; TLS interception by a proxy injecting content; network timeout producing a partial body; CAS misroute.

Related errors

• No principal was found in the response from the CAS server.
• 非法URL：主机名无法解析
• 调用大模型接口失败:
• 网页解析失败:
• 旁白生成失败，状态码: {statusCode}

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/886cd1cf580e767f. Report an issue: GitHub.